CVE-2026-90716
marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.
| CWE | CWE-125 CWE-119 |
| Vendor | marcobambini |
| Product | gravity |
| Published | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for marcobambini gravity
Be the first to know when new medium vulnerabilities affecting marcobambini gravity are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
marcobambini / Gravity
0.9.0 0.9.1 0.9.2 0.9.3 0.9.4 0.9.5 0.9.6 0.9.7
References
vuldb.com: https://vuldb.com/vuln/403270 vuldb.com: https://vuldb.com/vuln/403270/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90716 vuldb.com: https://vuldb.com/submit/919190 github.com: https://github.com/marcobambini/gravity/issues/446 github.com: https://github.com/marcobambini/gravity/pull/449 github.com: https://github.com/sthagen/marcobambini-gravity/commit/1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6 github.com: https://github.com/marcobambini/gravity/releases/tag/0.9.8 github.com: https://github.com/marcobambini/gravity/
Credits
🔍 lrrh (VulDB User)