Description
A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.
Published: 2026-09-14
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote memory corruption potentially leading to arbitrary code execution
Action: Patch Immediately
AI Analysis

Impact

Gravity contains a buffer overflow vulnerability in its JSON parser located in gravity_json.c. The flaw accepts crafted JSON input that corrupts memory, which an attacker can trigger remotely. The vulnerability is classified as a memory corruption weakness (CWE-119) and may allow an attacker to execute arbitrary code or crash the application.

Affected Systems

Gravity from the marcobambini project is affected, specifically all releases up to and including version 0.9.7. Upgrading to version 0.9.8 or later resolves the issue.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, but a public exploit exists. Based on the description, the attack vector is inferred to be remote, as the flaw is triggered through input received over a network connection. The exploit could be used by an unauthenticated attacker to corrupt memory and potentially execute code.

Generated by OpenCVE AI on September 14, 2026 at 20:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Gravity to version 0.9.8 or later
  • Limit access to the Gravity component by placing it behind a firewall or restricting it to trusted networks
  • Monitor the application for abnormal crashes or memory usage that could indicate exploitation attempts

Generated by OpenCVE AI on September 14, 2026 at 20:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.
Title marcobambini Gravity JSON parser gravity_json.c memory corruption
First Time appeared Marcobambini
Marcobambini gravity
Weaknesses CWE-119
CPEs cpe:2.3:a:marcobambini:gravity:*:*:*:*:*:*:*:*
Vendors & Products Marcobambini
Marcobambini gravity
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Marcobambini Gravity
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-14T12:15:10.922Z

Reserved: 2026-09-13T09:53:03.143Z

Link: CVE-2026-90714

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-09-14T13:19:29.887

Modified: 2026-09-14T20:56:48.220

Link: CVE-2026-90714

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-14T20:45:08Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer