PT-2026-33221 · Creolabs · Gravity

Segv0X · CVE-2026-40504 · Published 2026-04-16 · Updated 2026-04-16

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Creolabs Gravity versions prior to 0.9.6

Description A heap buffer overflow exists in the gravity vm exec() function. This issue allows attackers to write out-of-bounds memory by crafting scripts containing numerous string literals at the global scope. Furthermore, insufficient bounds checking in the gravity fiber reassign() function can be exploited to corrupt heap metadata, potentially leading to arbitrary code execution in applications that evaluate untrusted scripts.

Recommendations Update to version 0.9.6 or later.

Exploit

Fix

RCE

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2026-40504

Affected Products

Gravity

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40504.json · Exploit
• https://github.com/marcobambini/gravity/commit/18b9195598d9b944376754c6d1ad76e38a4adca1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40504 · Security Note
• https://osv.dev/vulnerability/CVE-2026-40504 · Vendor Advisory
• https://github.com/marcobambini/gravity/issues/437 · Note
• https://github.com/marcobambini/gravity · Note
• https://github.com/marcobambini/gravity/releases/tag/0.9.6 · Note
• https://twitter.com/VulmonFeeds/status/2044643555491135504 · Twitter Post
• https://twitter.com/0dayPublishing/status/2044595304213725352 · Twitter Post
• https://twitter.com/OrizonCyber/status/2044626893958254651 · Twitter Post
• https://twitter.com/CCBalert/status/2044776989572129007 · Twitter Post
• https://vulncheck.com/advisories/creolabs-gravity-heap-buffer-overflow-via-gravity-vm-exec · Note
• https://twitter.com/CVEnew/status/2044701593757700401 · Twitter Post