CVE-2026-90714: Gravity JSON Parser Buffer Overflow Flaw

CVE-2026-90714 Overview

CVE-2026-90714 is a memory corruption vulnerability in the Gravity programming language maintained by marcobambini. The flaw resides in the JSON parser component, specifically in the src/utils/gravity_json.c source file. Affected versions include Gravity up to and including 0.9.7. An attacker can trigger memory corruption remotely by supplying crafted JSON input to the parser. The issue is classified under [CWE-119] (improper restriction of operations within the bounds of a memory buffer). A public exploit has been disclosed, and upgrading to version 0.9.8 resolves the issue via patch 9b337c3eae5833c3956bed1fc01c21c14fd443f2.

Critical Impact
A remote attacker with low privileges can corrupt process memory through crafted JSON input, potentially impacting availability, integrity, and confidentiality of applications embedding the Gravity JSON parser.

Affected Products

marcobambini Gravity versions up to and including 0.9.7
Component: JSON parser (src/utils/gravity_json.c)
Fixed in Gravity release 0.9.8

Discovery Timeline

2026-09-14 - CVE-2026-90714 published to NVD
2026-09-15 - Last updated in NVD database
Patch commit - 9b337c3eae5833c3956bed1fc01c21c14fd443f2 merged into the Gravity repository

Technical Details for CVE-2026-90714

Vulnerability Analysis

Gravity is an embeddable scripting language written in C. The vulnerability affects an unspecified function inside src/utils/gravity_json.c, which implements the JSON parser and executable loader. Processing malformed or maliciously crafted JSON input causes memory corruption due to insufficient bounds enforcement, mapping to [CWE-119]. Because the parser is exposed to attacker-controlled input in applications that load or evaluate untrusted JSON, exploitation is reachable over the network. An EPSS score of 0.267% suggests limited active scanning today, but the availability of public exploit details raises the risk profile for embedded and CLI usage of Gravity.

Root Cause

The root cause is improper bounds handling within the JSON parsing routines. Reviewing the maintainer's patch commit 9b337c3 shows the fix is described as "harden the JSON executable loader and scanner (#444, #447, #448)," indicating the parser did not adequately validate input length or structure before performing memory operations. A dedicated bounds test harness (test/loadbuffer/json_bounds.c) was added alongside the fix.

Attack Vector

An attacker submits crafted JSON to a Gravity-based application that invokes the vulnerable parser. Because Gravity is often embedded into host applications and command-line tools, the delivery channel depends on how the JSON parser is exposed (file loading, network endpoint, or IPC). Successful exploitation corrupts memory in the target process, which can lead to denial of service or, depending on downstream memory layout, further compromise.

text

// Patch artifacts from commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2
// .gitignore addition — new hardened test binary tracked out of source control
 *.x86_64
 *.hex
 gravity
+jsontest
 
 # Debug files
 *.dSYM/

// Makefile addition — bounds test harness introduced with the fix
 OPT_DIR = src/optionals/
 GRAVITY_SRC = src/cli/gravity.c
 EXAMPLE_SRC = examples/example.c
+JSONTEST_SRC = test/loadbuffer/json_bounds.c

Source: GitHub Gravity Commit 9b337c3

Detection Methods for CVE-2026-90714

Indicators of Compromise

Crashes or abnormal termination of Gravity-based processes when parsing JSON input
Presence of Gravity binaries at versions 0.9.7 or earlier on production hosts
Unexpected memory access violations or heap corruption warnings originating from gravity_json.c

Detection Strategies

Perform software composition analysis (SCA) to identify applications embedding the Gravity interpreter at vulnerable versions
Enable AddressSanitizer or similar runtime memory checkers during testing to surface bounds violations in the JSON parser
Monitor process telemetry for repeated crashes correlated with JSON parsing activity in Gravity-linked processes

Monitoring Recommendations

Alert on segmentation faults or core dumps generated by processes that link against the Gravity runtime
Track ingestion of untrusted JSON files or payloads passed to Gravity CLI tools or embedded parsers
Review application logs for parser errors originating from src/utils/gravity_json.c execution paths

How to Mitigate CVE-2026-90714

Immediate Actions Required

Upgrade Gravity to version 0.9.8 or later, which contains commit 9b337c3eae5833c3956bed1fc01c21c14fd443f2
Inventory all internal applications and container images that embed the Gravity scripting engine
Restrict exposure of Gravity-based endpoints or CLI tools to untrusted JSON input until patched

Patch Information

The official fix is available in the GitHub Gravity Release 0.9.8. Details of the vulnerability report and remediation discussion are tracked in GitHub Gravity Issue #448 and GitHub Gravity Pull Request #451. Additional CVE metadata is available on VulDB CVE-2026-90714.

Workarounds

Validate and sanitize JSON input at the application layer before passing it to the Gravity parser
Enforce strict input size limits and reject malformed JSON payloads upstream of Gravity
Run Gravity-based components in sandboxed or least-privilege contexts to limit blast radius of memory corruption

bash

# Upgrade Gravity from source to the patched release
git clone https://github.com/marcobambini/gravity.git
cd gravity
git checkout 0.9.8
make clean && make

# Verify the version and confirm the bounds test target is present
./gravity --version
make jsontest