CVE-2026-40504 - Vulnerability Analysis

Overview

Creolabs Gravity < 0.9.6 contains a buffer overflow caused by insufficient bounds checking in gravity_vm_exec and gravity_fiber_reassign functions, letting attackers execute arbitrary code by crafting scripts with many global string literals, exploit requires evaluating untrusted scripts.

Severity & Score

Impact

Attackers can execute arbitrary code by exploiting heap buffer overflow in script evaluation, potentially compromising the application.

Mitigation

Upgrade to version 0.9.6 or later.

References

• https://github.com/marcobambini/gravity/commit/18b9195598d9b944376754c6d1ad76e38a4adca1
• https://github.com/marcobambini/gravity/issues/437
• https://github.com/marcobambini/gravity/releases/tag/0.9.6
• https://www.vulncheck.com/advisories/creolabs-gravity-heap-buffer-overflow-via-gravity-vm-exec

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner