CVE-2026-90716

marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds

View on CVE.org
Published Sep 14, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.

Analysis

AI-generated

Technical impact

This vulnerability arises from an out-of-bounds read in the parse_number_expression function of Gravity’s number parser. The flaw allows an attacker to read arbitrary memory beyond the intended buffer, potentially exposing sensitive data. The weakness is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Buffer) and CWE-125 (Out-of-Bounds Read).

Affected Systems

Gravity version 0.9.7 and all earlier releases of the marcobambini Gravity project are affected. The vulnerability is present only in the Number Parser component. The vendor is marcobambini and the product is Gravity.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by supplying crafted input to the parse_number_expression routine. The exploit is publicly available and does not require local privileges.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Gravity to version 0.9.8 or newer, which includes the fix (commit 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6). This eliminates the out-of-bounds read.
  • If an immediate upgrade is not possible, apply the provided patch commit to the source code before building and deploying Gravity.
  • As a temporary measure, validate or sanitize all inputs processed by the Number Parser component, and restrict its exposure to trusted data only.

Generated by OpenCVE AI on September 15, 2026 at 14:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.
Title marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds
First Time appeared Marcobambini
Marcobambini gravity
Weaknesses CWE-119
CWE-125
CPEs cpe:2.3:a:marcobambini:gravity:*:*:*:*:*:*:*:*
Vendors & Products Marcobambini
Marcobambini gravity
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125

    Out-of-bounds Read

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 16, 2026, 2:55 PM
Reserved
Sep 13, 2026, 9:53 AM

View source JSON

Updated
Sep 16, 2026, 2:55 PM

JSON

Status
Deferred
Published
Sep 14, 2026, 1:19 PM
Modified
Sep 16, 2026, 3:18 PM

View source JSON

No data.

Updated
Sep 15, 2026, 2:30 PM

JSON