CVE-2026-90714
mediumA weakness has been identified in marcobambini Gravity up to 0.9.7.
A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/marcobambini/gravity/ cna@vuldb.com
- https://github.com/marcobambini/gravity/issues/448 cna@vuldb.com
- https://github.com/marcobambini/gravity/pull/451 cna@vuldb.com
- https://github.com/marcobambini/gravity/releases/tag/0.9.8 cna@vuldb.com
- https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd... cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-90714 cna@vuldb.com
- https://vuldb.com/submit/919185 cna@vuldb.com
- https://vuldb.com/vuln/403268 cna@vuldb.com
- https://vuldb.com/vuln/403268/cti cna@vuldb.com