CVE Intelligence
Analysis AI-assisted

CVE-2026-40504: Creolabs Gravity < 0.9.6 Heap Buffer Overflow in gravity_vm_exec

Creolabs Gravity before 0.9.6 contains a heap-based buffer overflow in gravity_vm_exec that can be triggered by crafted script content. The record reports a CVSS 3.1 base score of 9.8 (critical) and describes possible code execution in applications that evaluate untrusted scripts. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-40504 is a heap-based buffer overflow (CWE-122) in Creolabs Gravity, reported as affecting versions before 0.9.6. The description places the flaw in the gravity_vm_exec function and links it to insufficient bounds checking in gravity_fiber_reassign().

Impact

  • The record states that out-of-bounds memory writes could corrupt heap metadata.
  • The description says this could lead to arbitrary code execution in applications that evaluate untrusted scripts.
  • VulnCheck scores the issue at CVSS 3.1 9.8 (critical), with an availability, confidentiality and integrity impact rated high in the vector, and a CVSS 4.0 score of 9.3.

Affected products and versions

  • Product in record: Marcobambini Gravity (presented as Creolabs Gravity in the title and description).
  • Affected range in record: versions before 0.9.6.
  • The record also lists a commit-based range. The patch reference in the record is tagged as a patch commit in the upstream repository.

Exploitation status

  • The CISA KEV entry is not listed in the record, so no active exploitation is confirmed by KEV.
  • The SSVC field in the record is marked as exploitation state "poc", which indicates a proof-of-concept level assessment. This is not the same as confirmed exploitation in the wild.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade Gravity to version 0.9.6 or later, which is the boundary given by the affected range and the release reference in the record.
  • Review the upstream patch commit and the project issue tracker to confirm the fix in your build.
  • If upgrading is not immediate, limit evaluation of untrusted scripts and isolate the interpreter in a constrained process or sandbox. Treat this as a compensating control, not a fix.

Detection guidance

  • Inventory applications that embed Gravity and record their version, especially those that evaluate user-supplied or third-party scripts.
  • Monitor for crashes, memory corruption signals or unexpected process behaviour in components that run Gravity scripts.
  • Review logs for script evaluation from untrusted sources at a high level, without relying on specific payload signatures, since none are provided in the record.

Limitations of the available information

  • The record does not list fixed versions in its structured fields, so the 0.9.6 boundary is taken from the affected range and the release reference.
  • The record's source_status is "Deferred", and its meaning is not explained.
  • Exploit details, proof-of-concept code and the exact conditions for code execution are not provided, and this analysis does not add them.
  • The record does not state the exact memory layout or platform requirements.

Frequently asked questions

Which Gravity versions are affected by CVE-2026-40504?

The record lists versions before 0.9.6 as affected. It also lists a commit-based range, so the upstream commit history should be checked for your build.

Is CVE-2026-40504 known to be actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC field marks exploitation as proof-of-concept level.

What should administrators do first?

Inventory applications that embed Gravity, upgrade to 0.9.6 or later where possible, and limit evaluation of untrusted scripts until the upgrade is complete.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.