Creolabs Gravity before 0.9.6 contains a heap buffer overflow in the gravity_vm_exec function that lets an attacker create scripts with an abundance of global string literals to trigger insufficient bounds checking in gravity_fiber_reassign(). This out‑of‑bounds write corrupts heap metadata and can be leveraged to run arbitrary code wherever the Gravity VM evaluates untrusted scripts, directly compromising confidentiality, integrity, and availability of the affected application.

The vulnerability affects instances of Creolabs Gravity packaged under the marcobambini:gravity identifier. All releases prior to version 0.9.6 are vulnerable; versions 0.9.6 and later contain the necessary patch.

With a CVSS score of 9.3 the flaw is rated critical. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, so on‑demand exploitation is not widely known. However, the attack vector is clear: an attacker who can supply a Gravity script containing many string literals at the global scope can trigger the overflow and achieve arbitrary code execution. The required conditions are typical of any application that allows customers to run arbitrary scripts through the Gravity engine.