CVE-2026-40504
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A heap buffer overflow vulnerability exists in Creolabs Gravity before version 0.9.6 in the gravity_vm_exec function. Attackers can exploit scripts with many string literals at global scope to write out-of-bounds memory.
Risk Assessment
This vulnerability allows arbitrary code execution in applications that evaluate untrusted Gravity scripts, potentially leading to system compromise or data leakage.
Recommendation
Upgrade Creolabs Gravity to version 0.9.6 or later immediately. In the meantime, restrict processing of scripts from untrusted sources.
Other vulnerabilities in Creolabs Gravity
See all- CVE-2017-1000173Critical
In Creolabs Gravity version 1.0, there is a heap buffer overflow vulnerability that may lead to code execution. By creating a large loop while pushing data to a buffer, the bounds checking of that buffer can be bypassed.
- CVE-2017-1000075Critical
Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function.
- CVE-2017-1000074Critical
Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.
- CVE-2017-1000073Critical
Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.
Original NVD description (English source)
Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravity_fiber_reassign() to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS