Remote code execution via table-column counter overflow

Integer overflow in CommonMarker before 0.23.4 allows remote attackers to corrupt heap memory through crafted Markdown table marker rows. The cmark-gfm row_from_string function increments its 16-bit n_columns counter without rejecting more than UINT16_MAX columns, so the counter wraps while the cell list continues growing. Exploitation requires an application to render attacker-controlled Markdown with the table extension enabled and can disclose memory or execute code in that application's process.