CVE-2026-40504

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40504", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-13T20:29:02.808Z", "datePublished": "2026-04-16T01:10:27.364Z", "dateUpdated": "2026-11-08T14:02:50.663Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:02:50.663Z"}, "title": "Creolabs Gravity < 0.9.6 Heap Buffer Overflow via gravity_vm_exec", "descriptions": [{"lang": "en", "value": "Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravity_fiber_reassign() to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravity_fiber_reassign() to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts.<br>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "type": "CWE"}]}], "affected": [{"vendor": "marcobambini", "product": "gravity", "repo": "https://github.com/marcobambini/gravity", "versions": [{"status": "affected", "version": "0", "lessThan": "0.9.6", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "18b9195598d9b944376754c6d1ad76e38a4adca1", "versionType": "git"}], "defaultStatus": "unaffected", "packageURL": "pkg:github/marcobambini/gravity"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "references": [{"url": "https://github.com/marcobambini/gravity/releases/tag/0.9.6", "name": "gravity 0.9.6 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/marcobambini/gravity/issues/437", "tags": ["issue-tracking"]}, {"url": "https://github.com/marcobambini/gravity/commit/18b9195598d9b944376754c6d1ad76e38a4adca1", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/creolabs-gravity-heap-buffer-overflow-via-gravity-vm-exec", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "segv0x", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T13:45:28.279979Z", "id": "CVE-2026-40504", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:45:35.255Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40504", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T13:45:28.279979Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:45:05.634Z"}}], "cna": {"title": "Creolabs Gravity < 0.9.6 Heap Buffer Overflow via gravity_vm_exec", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "segv0x"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/marcobambini/gravity", "vendor": "marcobambini", "product": "gravity", "versions": [{"status": "affected", "version": "0", "lessThan": "0.9.6", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "18b9195598d9b944376754c6d1ad76e38a4adca1", "versionType": "git"}], "packageURL": "pkg:github/marcobambini/gravity", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/marcobambini/gravity/releases/tag/0.9.6", "name": "gravity 0.9.6 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/marcobambini/gravity/issues/437", "tags": ["issue-tracking"]}, {"url": "https://github.com/marcobambini/gravity/commit/18b9195598d9b944376754c6d1ad76e38a4adca1", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/creolabs-gravity-heap-buffer-overflow-via-gravity-vm-exec", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravity_fiber_reassign() to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts.", "supportingMedia": [{"type": "text/html", "value": "Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravity_fiber_reassign() to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:02:50.663Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40504", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:02:50.663Z", "dateReserved": "2026-04-13T20:29:02.808Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-16T01:10:27.364Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/marcobambini/gravity", "product": "gravity", "repo": "https://github.com/marcobambini/gravity", "vendor": "marcobambini", "versions": [{"lessThan": "0.9.6", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "18b9195598d9b944376754c6d1ad76e38a4adca1", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Creolabs Gravity before 0.9.6 contains a heap buffer overflow vulnerability in the gravity_vm_exec function that allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit insufficient bounds checking in gravity_fiber_reassign() to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts."}, {"lang": "es", "value": "Creolabs Gravity antes de 0.9.6 contiene una vulnerabilidad de desbordamiento de b\u00fafer de mont\u00f3n en la funci\u00f3n gravity_vm_exec que permite a los atacantes escribir memoria fuera de l\u00edmites mediante la creaci\u00f3n de scripts con muchos literales de cadena en el \u00e1mbito global. Los atacantes pueden explotar la comprobaci\u00f3n de l\u00edmites insuficiente en gravity_fiber_reassign() para corromper los metadatos del mont\u00f3n y lograr la ejecuci\u00f3n de c\u00f3digo arbitrario en aplicaciones que eval\u00faan scripts no confiables."}], "id": "CVE-2026-40504", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40504", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T13:45:28.279979Z", "version": "2.0.3"}}]}, "published": "2026-04-16T02:16:11.693", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/marcobambini/gravity/commit/18b9195598d9b944376754c6d1ad76e38a4adca1"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/marcobambini/gravity/issues/437"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/marcobambini/gravity/releases/tag/0.9.6"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/creolabs-gravity-heap-buffer-overflow-via-gravity-vm-exec"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.9.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0,18b9195598d9b944376754c6d1ad76e38a4adca1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gravity", "source": "cna", "vendor": "marcobambini"}, "product": "gravity", "vendor": "marcobambini"}], "analysis": {"en": {"generated_at": "2026-04-16T02:12:51.844597+00:00", "value": {"mitigation_remediation": ["Update to gravity version 0.9.6 or later, which includes the heap overflow fix.", "If an upgrade cannot be performed immediately, disable or tightly restrict the execution of untrusted scripts within applications that embed Gravity.", "Monitor application logs for signs of memory corruption or abnormal execution patterns that might indicate exploitation attempts."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary Code Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects instances of Creolabs Gravity packaged under the marcobambini:gravity identifier. All releases prior to version 0.9.6 are vulnerable; versions 0.9.6 and later contain the necessary patch.", "description_and_impact": "Creolabs Gravity before 0.9.6 contains a heap buffer overflow in the gravity_vm_exec function that lets an attacker create scripts with an abundance of global string literals to trigger insufficient bounds checking in gravity_fiber_reassign(). This out\u2011of\u2011bounds write corrupts heap metadata and can be leveraged to run arbitrary code wherever the Gravity VM evaluates untrusted scripts, directly compromising confidentiality, integrity, and availability of the affected application.", "risk_and_exploitability": "With a CVSS score of 9.3 the flaw is rated critical. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, so on\u2011demand exploitation is not widely known. However, the attack vector is clear: an attacker who can supply a Gravity script containing many string literals at the global scope can trigger the overflow and achieve arbitrary code execution. The required conditions are typical of any application that allows customers to run arbitrary scripts through the Gravity engine."}}}}, "created": "2026-04-16T02:15:21.323361+00:00", "updated": "2026-04-16T09:12:05.197753+00:00", "vendors": ["marcobambini", "marcobambini$PRODUCT$gravity"]}