CVE-2026-90716 - Vulnerability Details

- marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds

Description

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.

Published: 2026-09-14

Score: 5.1 Medium

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability arises from an out-of-bounds read in the parse_number_expression function of Gravity’s number parser. The flaw allows an attacker to read arbitrary memory beyond the intended buffer, potentially exposing sensitive data. The weakness is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Buffer) and CWE-125 (Out-of-Bounds Read).

Affected Systems

Gravity version 0.9.7 and all earlier releases of the marcobambini Gravity project are affected. The vulnerability is present only in the Number Parser component. The vendor is marcobambini and the product is Gravity.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by supplying crafted input to the parse_number_expression routine. The exploit is publicly available and does not require local privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

marcobambini

Gravity

affected

Version	Status	Constraints
`0.9.0`	affected	—
`0.9.1`	affected	—
`0.9.2`	affected	—
`0.9.3`	affected	—
`0.9.4`	affected	—
`0.9.5`	affected	—
`0.9.6`	affected	—
`0.9.7`	affected	—
`0.9.8`	unaffected	—

No data.

Vendor Product Confidence Versions

Marcobambini

Gravity

95%

Version	Status	Scheme	Platform
`0.9.0`	affected	semver	—
`0.9.1`	affected	semver	—
`0.9.2`	affected	semver	—
`0.9.3`	affected	semver	—
`0.9.4`	affected	semver	—
`0.9.5`	affected	semver	—
`0.9.6`	affected	semver	—
`0.9.7`	affected	semver	—
`0.9.8`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Gravity to version 0.9.8 or newer, which includes the fix (commit 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6). This eliminates the out-of-bounds read.
If an immediate upgrade is not possible, apply the provided patch commit to the source code before building and deploying Gravity.
As a temporary measure, validate or sanitize all inputs processed by the Number Parser component, and restrict its exposure to trusted data only.

Generated by OpenCVE AI on September 14, 2026 at 20:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/marcobambini/gravity/
https://github.com/marcobambini/gravity/issues/446
https://github.com/marcobambini/gravity/pull/449
https://github.com/marcobambini/gravity/releases/tag/0.9.8
https://github.com/sthagen/marcobambini-gravity/commit/1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6
https://vuldb.com/cve/CVE-2026-90716
https://vuldb.com/submit/919190
https://vuldb.com/vuln/403270
https://vuldb.com/vuln/403270/cti

History

Mon, 14 Sep 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.
Title		marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds
First Time appeared		Marcobambini Marcobambini gravity
Weaknesses		CWE-119 CWE-125
CPEs		cpe:2.3:a:marcobambini:gravity::::::::
Vendors & Products		Marcobambini Marcobambini gravity
References		https://github.com/marcobambini/gravity/ https://github.com/marcobambini/gravity/issues/446 https://github.com/marcobambini/gravity/pull/449 https://github.com/marcobambini/gravity/releases/tag/0.9.8 https://github.com/sthagen/marcobambini-gravity/commit/1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6 https://vuldb.com/cve/CVE-2026-90716 https://vuldb.com/submit/919190 https://vuldb.com/vuln/403270 https://vuldb.com/vuln/403270/cti
Metrics		cvssV2_0 `{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Marcobambini Gravity

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-14T12:45:10.603Z

Updated: 2026-09-14T12:45:10.603Z

Reserved: 2026-09-13T09:53:09.606Z

Link: CVE-2026-90716

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-09-14T13:19:30.287

Modified: 2026-09-14T20:56:48.220

Link: CVE-2026-90716

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-14T20:45:08Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object