CVE-2026-40504 Details
Description
Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravity_fiber_reassign() to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts.
A heap buffer overflow vulnerability has been identified in Creolabs Gravity versions prior to 0.9.6. The issue arises in the 'gravity_vm_exec' function, where attackers can write out-of-bounds memory by creating scripts with numerous string literals at the global scope. This vulnerability takes advantage of inadequate bounds checking in 'gravity_fiber_reassign()', leading to corruption of heap metadata and potentially allowing arbitrary code execution in applications that process untrusted scripts.
Users can upgrade to Creolabs Gravity version 0.9.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 16, 2026CISA-ADP
Assessed Apr 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/marcobambini/gravity/commit/18b9195598d9b944376754c6d1ad76e38a4adca1 | [email protected] | Source CodeVendor |
| https://github.com/marcobambini/gravity/issues/437 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/marcobambini/gravity/releases/tag/0.9.6 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/creolabs-gravity-heap-buffer-overflow-via-gravity-vm-exec | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Creolabs Gravity | < 0.9.6 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | New CVE Received | [email protected] |