CVE-2026-90716: Gravity Parser Buffer Overflow Vulnerability

CVE-2026-90716 Overview

CVE-2026-90716 is an out-of-bounds read vulnerability in the Gravity programming language interpreter maintained by marcobambini. The flaw resides in the parse_number_expression function within src/compiler/gravity_parser.c, part of the Number Parser component. Versions up to and including 0.9.7 are affected, and the issue is fixed in version 0.9.8 via commit 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. A public exploit exists, and the attack can be initiated remotely, though it requires low privileges and user interaction. The vulnerability is classified under [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer].

Critical Impact
A crafted Gravity source input can trigger a heap out-of-bounds read in the number parser, potentially leaking adjacent memory or causing process instability in applications that compile untrusted Gravity scripts.

Affected Products

marcobambini Gravity versions up to and including 0.9.7
Component: Number Parser (src/compiler/gravity_parser.c)
Function: parse_number_expression

Discovery Timeline

2026-09-14 - CVE-2026-90716 published to NVD
2026-09-16 - Last updated in NVD database
Fix commit - 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6 merged and released as Gravity 0.9.8

Technical Details for CVE-2026-90716

Vulnerability Analysis

The Gravity parser reads numeric literals by inspecting bytes directly from the source token buffer. In vulnerable builds, parse_number_expression peeks at value[1] after checking that value[0] == '0', without confirming that the token contains at least two bytes. The token buffer is a pointer into the source text and is not guaranteed to be null-terminated. When a numeric token consists of a single 0 character positioned at the end of the input buffer, the parser reads past the allocated region.

This behavior corresponds to an out-of-bounds read on the heap. The read does not directly enable code execution, but it can disclose adjacent heap memory to callers that observe parser state, and it can crash processes that embed the Gravity compiler. The public GitHub Issue #446 documents the reproduction case, and Pull Request #449 introduces the length check.

Root Cause

The root cause is a missing bounds check on token.bytes before the parser dereferences the second byte of the token buffer. Because token.value aliases directly into the compiler's source buffer rather than a null-terminated copy, single-character 0 tokens near the end of input cause the parser to read one byte beyond the allocation.

Attack Vector

Exploitation requires an attacker to submit a Gravity script to a target that compiles or evaluates untrusted Gravity source. Applications that expose Gravity scripting to remote users, such as embedded scripting endpoints or plugin systems, present the practical attack surface. User interaction is required to submit or load the malicious script.

     int64_t        n = 0;
     double        d = 0;
 
-    if (value[0] == '0') {
+    // token.value points directly into the source buffer, which is not guaranteed to be
+    // zero terminated, so make sure the token is at least 2 bytes before peeking at value[1]
+    if ((token.bytes > 1) && (value[0] == '0')) {
         int c = toupper(value[1]);
         if (c == 'B') {type = decode_number_binary(token, &n); goto report_node;}
         else if (c == 'O') {type = decode_number_octal(token, &n); goto report_node;}

Source: GitHub Commit 1b9bbf3 — the patch adds a token.bytes > 1 guard before reading value[1].

Detection Methods for CVE-2026-90716

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that link or embed the Gravity interpreter when parsing user-supplied scripts.
AddressSanitizer or Valgrind reports of heap-buffer-overflow reads originating in parse_number_expression at src/compiler/gravity_parser.c.
Submission of Gravity source files that terminate with an isolated single-digit 0 token with no trailing whitespace or newline.

Detection Strategies

Inventory hosts and applications that ship the Gravity interpreter and compare installed versions against the fixed release 0.9.8.
Rebuild embedding applications with AddressSanitizer enabled during quality assurance to surface out-of-bounds reads in parser code paths.
Review application logs from services that expose Gravity script evaluation for parser errors or abnormal termination correlated with untrusted input.

Monitoring Recommendations

Alert on repeated crashes of processes that embed gravity when handling network-supplied script payloads.
Correlate submissions of Gravity scripts from untrusted sources with process exit codes and core dumps.
Track upstream advisories on the Gravity GitHub project and the VulDB entry for CVE-2026-90716 for exploit updates.

How to Mitigate CVE-2026-90716

Immediate Actions Required

Upgrade to Gravity 0.9.8 or later, which contains the fix from commit 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6.
Rebuild and redeploy any applications that statically link the Gravity interpreter after upgrading the source tree.
Restrict submission of Gravity scripts from untrusted or anonymous users until the upgrade is complete.

Patch Information

The fix is available in the Gravity 0.9.8 release and was introduced through Pull Request #449, which resolves Issue #446. The patch adds a length check ensuring token.bytes > 1 before dereferencing the second byte of the numeric token buffer.

Workarounds

If upgrading is not immediately feasible, apply the two-line patch from commit 1b9bbf3 to src/compiler/gravity_parser.c and rebuild.
Pre-process Gravity source input to append a trailing newline or null terminator before passing it to the compiler, reducing the likelihood of the out-of-bounds read on single-digit terminal tokens.
Limit Gravity script execution to trusted, authenticated users pending remediation.

bash

# Upgrade Gravity from source
git clone https://github.com/marcobambini/gravity.git
cd gravity
git checkout 0.9.8
make clean && make
# Verify the fix commit is present
git log --oneline | grep 1b9bbf3