Technical impact
Gravity’s UDP JSON parser can be tricked into performing an integer overflow when processing specially crafted JSON data received over UDP, an error associated with both CWE-190 (Integer Overflow or Wraparound) and CWE-189 (Numeric Truncation or Overflows). This overflow can destabilise the parsing routine, potentially corrupting memory or causing the application to crash. The vulnerability is exploitable from a remote location; an attacker can craft packets to trigger it without needing local access. The primary impact is a moderate loss of integrity and availability for systems running unpatched Gravity versions, with the possibility of further exploitation depending on specific environmental factors.
Affected Systems
The Gravity project by marcobambini, versions up to and including 0.9.7, are vulnerable. Releasing the 0.9.8 update fixes the issue, as identified by the commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2. All other versions of Gravity that include earlier or modified code without this patch remain exposed.
Risk and Exploitability
The CVSS score of 6.9 categorises the flaw as medium severity. No EPSS score is available, so there is no concrete data on exploitation likelihood, and the vulnerability is vector is remote, leveraging malformed UDP packets that are parsed by the vulnerable JSON routine. An attacker could induce crashes, denial‑of‑service conditions or, depending on system configuration, potentially more damaging memory corruption. Organizations should consider the CVSS rating and known public exploitation when prioritising remediation.
