CVE-2026-90714 Details
Description
A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.
A memory corruption vulnerability has been identified in Marcobambini Gravity versions through 0.9.7. The issue arises in an unknown function within the JSON parser component, specifically in the file 'src/utils/gravity_json.c'. The vulnerability can be exploited remotely, and the exploit has been made public. The root cause is a pointer arithmetic overflow, where the JSON parser's scan loop can advance past the end of the buffer, leading to undefined behavior. This vulnerability is reachable through the C API by loading malformed bytecode that the parser misinterprets, creating an out-of-bounds pointer.
Upgrading to Gravity version 0.9.8 addresses this vulnerability. Instructions for downloading the latest version are available on the Gravity GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/marcobambini/gravity/ | [email protected] | Vendor |
| https://github.com/marcobambini/gravity/issues/448 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/marcobambini/gravity/pull/451 | [email protected] | Issue TrackingVendor |
| https://github.com/marcobambini/gravity/releases/tag/0.9.8 | [email protected] | Release NotesVendor |
| https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2 | [email protected] | Source Code |
| https://vuldb.com/cve/CVE-2026-90714 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/919185 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403268 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/403268/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| marcobambini Gravity | 0.9.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |