Description

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T13:19:29.887Z",
  "pubdate": "2026-09-14T13:19:29.887Z",
  "executiveSummary": "A critical memory corruption vulnerability has been identified in the Gravity programming language, specifically within its JSON parsing utility.\nThe flaw resides in the src/utils/gravity_json.c component and affects versions up to 0.9.7.\nThis vulnerability allows for remote exploitation, potentially enabling attackers to trigger unstable memory states.\nSuch memory corruption issues often serve as vectors for arbitrary code execution or denial-of-service conditions, posing a significant risk to applications integrated with affected Gravity versions.\nPublicly available exploit code increases the urgency for remediation.\nOrganizations utilizing Gravity should immediately upgrade to version 0.9.8 to mitigate this threat.",
  "technicalDetails": "The vulnerability is situated within the JSON parsing logic implemented in src/utils/gravity_json.c of the Gravity component.\nThe root cause involves improper handling of input data during the parsing process, which fails to safely manage memory allocation or bounds checking when processing maliciously crafted JSON payloads.\nExploitation occurs when a remote attacker submits a specially crafted JSON input to an application utilizing the affected Gravity parser. Upon ingestion, the parser encounters unexpected input structures that deviate from expected specifications, leading to a memory corruption event.\nThe attack flow typically involves an attacker identifying an input vector that reaches the vulnerable parsing function. By manipulating the structure of the JSON content, the attacker induces an out-of-bounds access or a use-after-free scenario within the heap or stack memory spaces managed by the parser.\nGiven that the vulnerability is present in the core JSON parsing utility, any software relying on this component to process untrusted JSON data is inherently at risk of compromise.\nThe technical impact of such memory corruption includes the potential for control-flow hijacking if the attacker can influence the execution path through corrupted function pointers or return addresses. Furthermore, it can lead to immediate process crashes, resulting in a denial-of-service condition for the host application.\nThere are no specific authentication or privilege requirements noted for the triggering of this vulnerability, as the parser is intended to process incoming data streams, making it accessible to any remote entity capable of delivering the payload.\nThe remediation, documented in commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2, addresses these deficiencies by tightening input validation and memory safety checks within the JSON processing routine, effectively neutralizing the exploitation vector present in version 0.9.7 and earlier."
}