CVE-2026-90714

Deferred Deferred - Pending Action

Memory Corruption in Gravity JSON Parser

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: VulDB

Description

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-09-15

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90714

EUVD

EUVD-2026-77436

Affected Vendors & Products

Vendor	Product	Version / Range
marcobambini	gravity	to 0.9.7 (inc)
marcobambini	gravity	to 0.9.8 (exc)
marcobambini	gravity	0.9.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory corruption issue in the Gravity programming language up to version 0.9.7. It occurs in the JSON parser component, specifically in the file src/utils/gravity_json.c. The flaw involves a pointer arithmetic overflow in the json_parse_ex function, where the parser's scan loop advances past the end of the input buffer due to malformed input like unterminated strings. This causes undefined behavior, potentially leading to crashes or denial-of-service conditions. The issue is triggered through the gravity_vm_loadbuffer function, which processes attacker-controlled serialized bytecode.

Detection Guidance

To detect this vulnerability, check if Gravity versions up to 0.9.7 are installed. Use commands like 'gravity --version' or inspect package managers for the affected version. Monitor logs for crashes or memory corruption errors in JSON parsing operations.

Impact Analysis

This vulnerability could allow remote attackers to cause memory corruption, leading to crashes or denial-of-service attacks on systems using affected versions of Gravity. If exploited, it might enable arbitrary code execution or data corruption, depending on the system's configuration and the attacker's goals. The public availability of an exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability involves memory corruption due to a pointer arithmetic overflow in the JSON parser, which could lead to crashes or denial-of-service conditions. While not directly impacting GDPR or HIPAA compliance, such vulnerabilities may expose systems to unauthorized access or data breaches if exploited, potentially violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Gravity to version 0.9.8 or later immediately. This resolves the memory corruption issue in the JSON parser. Apply the patch 9b337c3eae5833c3956bed1fc01c21c14fd443f2 if upgrading is not immediately possible.

Hi! I’m here to help you understand CVE-2026-90714. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70