Description

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-14T13:19:30.287Z",
  "pubdate": "2026-09-14T13:19:30.287Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability exists in the Gravity programming language, specifically within the number parsing logic of the compiler.\nThe vulnerability resides in the parse_number_expression function located in src/compiler/gravity_parser.c, affecting all versions up to and including 0.9.7.\nThe flaw allows a remote attacker to trigger an out-of-bounds read by providing a maliciously crafted number expression.\nThis type of memory safety error poses significant risks, as it can lead to unauthorized information disclosure, potentially exposing sensitive memory contents, or lead to application instability and denial-of-service (DoS) conditions.\nThe exploit is currently public, significantly increasing the risk of active exploitation in production environments.\nThe vulnerability does not explicitly require authenticated access, implying that remote, unauthenticated attackers could potentially leverage this flaw if the Gravity parser is exposed to untrusted input.\nImmediate remediation is strongly advised by upgrading to version 0.9.8, which contains the necessary security patch.",
  "technicalDetails": "The vulnerability is an out-of-bounds read located in the Number Parser component of the Gravity compiler, specifically within the parse_number_expression function defined in src/compiler/gravity_parser.c.\nThe root cause of this vulnerability is improper boundary checking during the lexical analysis or parsing phase when the engine encounters specific numeric expressions.\nWhen the parser attempts to process a sequence of bytes intended to represent a number, it fails to correctly validate the input length or the pointer offset relative to the buffer bounds. Consequently, the parser may read data residing outside the allocated memory segment dedicated to the input string.\nThe attack flow initiates when a remote user supplies a malformed numeric input to an application or service that utilizes the Gravity parser for code compilation or execution. The attacker crafts a payload that intentionally violates the expected syntax or length constraints of the parser's numeric validation logic.\nUpon reaching the parse_number_expression function, the compiler's internal pointer arithmetic fails to prevent the read operation from traversing beyond the valid character array. Because the parser proceeds with this out-of-bounds access, it effectively captures adjacent memory contents into its internal data structures.\nThe impact of this exploitation depends on the memory layout of the host process at the time of the read. At a minimum, this can cause a segmentation fault, resulting in a denial-of-service. More severely, if the read data is subsequently reflected back to the user or used in a way that leaks sensitive information (such as heap pointers, function addresses, or other data structures), it can be used to facilitate further, more complex exploitation, such as bypassing Address Space Layout Randomization (ASLR).\nSince the exploit is currently public, the attack complexity is considered low for threat actors. No specific user interaction is required if the parser is accessible via a network-facing service, and the vulnerability can be triggered remotely without prior authentication.\nThe vulnerability is addressed in patch 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6, which implements rigorous bounds checking within the affected parser function to ensure that memory access operations remain within the legitimate buffer limits."
}