CVE-2026-90714: marcobambini Gravity JSON parser gravity_json.c memory corruption
A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravityjson.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
marcobambini Gravity (JSON parser) src/utils/gravity_json.cto a version that resolves this vulnerability.Fixed in 0.9.8Patch 9b337c3eae5833c3956bed1fc01c21c14fd443f2
Event History
Frequently Asked Questions
Which deployments are affected?
Gravity versions up to and including 0.9.7 are affected. The issue is in the JSON parser component, specifically src/utils/gravity_json.c.
What access does an attacker need?
The issue can be exploited remotely with low attack complexity, but the supplied severity vector indicates that the attacker requires low-level privileges. No user interaction is required.
Is public exploit code available?
Yes. The vulnerability information states that an exploit has been made publicly available and could be used in attacks.
How should this be remediated?
Upgrade Gravity to version 0.9.8. The available patch is identified as 9b337c3eae5833c3956bed1fc01c21c14fd443f2.