{"id":"CVE-2026-90714","summary":"marcobambini Gravity JSON parser gravity_json.c memory corruption","details":"A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.","modified":"2026-09-17T08:06:08.066466Z","published":"2026-09-14T12:15:10.922Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-119"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90714.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0.9.1"},{"last_affected":"0.9.1"},{"introduced":"0.9.2"},{"last_affected":"0.9.2"},{"introduced":"0.9.3"},{"last_affected":"0.9.3"},{"introduced":"0.9.4"},{"last_affected":"0.9.4"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://github.com/marcobambini/gravity/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90714.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90714"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90714"},{"type":"ADVISORY","url":"https://vuldb.com/submit/919185"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403268"},{"type":"REPORT","url":"https://github.com/marcobambini/gravity/issues/448"},{"type":"REPORT","url":"https://vuldb.com/vuln/403268/cti"},{"type":"FIX","url":"https://github.com/marcobambini/gravity/pull/451"},{"type":"FIX","url":"https://github.com/marcobambini/gravity/releases/tag/0.9.8"},{"type":"FIX","url":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/marcobambini/gravity","events":[{"introduced":"9fccc47b8bd43ec1ac8a2868b938e2d64c2806aa"},{"fixed":"40a26f2c81051af00544e7a667ff5b1084b9937c"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0.9.0"},{"last_affected":"0.9.0"},{"introduced":"0.9.5"},{"last_affected":"0.9.5"},{"introduced":"0.9.6"},{"last_affected":"0.9.6"},{"introduced":"0.9.7"},{"last_affected":"0.9.7"}]}},{"type":"GIT","repo":"https://github.com/sthagen/marcobambini-gravity","events":[{"introduced":"0"},{"fixed":"9b337c3eae5833c3956bed1fc01c21c14fd443f2"}],"database_specific":{"source":"REFERENCES"}}],"versions":["0.9.0","0.9.5","0.9.6","0.9.7","v0.9.5","0.7.8","0.7.7","0.7.6","0.7.5","0.7.4","0.7.0","0.6.9","0.6.7","0.6.6","0.6.5","0.6.4","0.6.3","0.6.1","0.6.0","0.5.9","0.5.8","0.5.6","0.5.5","0.5.4","0.5.1","0.5.0","0.4.9","0.4.8","0.4.7","0.4.5","0.4.4","0.4.3","0.4.2","0.4.1","0.4.0","0.3.8","0.3.7","0.3.6","0.3.5","0.3.0","0.2.8"],"database_specific":{"vanir_signatures_modified":"2026-09-17T08:06:08Z","vanir_signatures":[{"digest":{"function_hash":"232200379404445366365036093969002427147","length":12363},"id":"CVE-2026-90714-122019dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/utils/gravity_json.c","function":"json_parse_ex"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/utils/gravity_json.h"},"deprecated":false,"digest":{"line_hashes":["26024780977641638348574132098132970872","260844202045014263856956935377161678601","300823103471968379120022696207420363584"],"threshold":0.9},"id":"CVE-2026-90714-1986bf57"},{"target":{"file":"src/utils/gravity_utils.c","function":"file_buildpath"},"deprecated":false,"digest":{"function_hash":"280251523899474841246980219471860752856","length":512},"id":"CVE-2026-90714-30b6a0fc","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c"},{"id":"CVE-2026-90714-3f8305fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_size"},"deprecated":false,"digest":{"function_hash":"175537896541162334888258530959801595990","length":350}},{"deprecated":false,"digest":{"line_hashes":["55892825186232913940297716845038020019","62552191506194730925217264240326149201","206867632584928810467891465941406731946","199296733975424838780751954136441734565","254041168489817386337136450409028383288","226119223955728670483856833969229202442","283531147810570819363685977083317003073","297674591424661520175631287873532996676","59351655657689352259326931835898935296","198850574567507344889956286657440677709","43820989809423365602986665707782721444","333053095484237793277846892264042089116","24573199715883699655076502476775953957","238976751286574114322985650447923072092","230700890109573394187024479106695983604","12626878027326228661927200480927750621","297174895791954990736312548567231229155","127244610020960159663139378842308001422","97370015863764898093369150077617193861","154190552253092280130291321232855442442","113524320659024744932795714841526999929","174368872456107073156949017426649303121","268522901857870817026393471972548062785","173274423157752955822210048033798246705","165616279679916301891811515839534050642","85315151951555543941759157729317577922","247769806382558406050032537813383549039","245178942849593251631984448723459968029","7211574166004230399621160334157072374","200972001851849836447313564865030703239","136630715194097056876083571868622446274","90486356244964638103312258238636010155","126801801320087959567622973650350329946","146926604129103191187292452293766200472","321731540757589718176912373950737549313","144750055792911738293000894879826691792","183064395409210398648220737178902366811","146571279115049350987060440809497191074","7137988671695777274793233156649088886","128982921761728795345327139890497432069","302912295921743117905204576539684502677","159990436404323654935265324301782601101","271490182198287648451448080731980143204","76318575503156263163499697074791335835","250532382376627658717277368713010269631","81558316154652019083337278284465555882","80528558335523852886811723047947950743","209340005783408719228722317315119492441","37096150076181999812715277108235426577","13867399101420555287175660330451477578","57537240610017428659671530890464526635"],"threshold":0.9},"id":"CVE-2026-90714-58337b4a","signature_type":"Line","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/utils/gravity_json.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/optionals/gravity_opt_file.c"},"deprecated":false,"digest":{"line_hashes":["96651144436907160232074504838707307494","213230403875323693952521923652550117896","324125323960775487364419528686619175142","304731589433403457228151585164611957017"],"threshold":0.9},"id":"CVE-2026-90714-5a7d172e"},{"deprecated":false,"digest":{"function_hash":"248731748528432841804395213972952232917","length":965},"id":"CVE-2026-90714-5fa7ccd1","signature_type":"Function","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/shared/gravity_hash.c","function":"murmur3_32"}},{"target":{"file":"src/utils/gravity_utils.c","function":"directory_read"},"deprecated":false,"digest":{"function_hash":"21043015588810320897173356749066040767","length":736},"id":"CVE-2026-90714-64f51aa0","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c"},{"source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/cli/gravity.c"},"deprecated":false,"digest":{"line_hashes":["222311800301159257551802957815531412578","227891431396206675631259796725117238812","239800484188899712317325038789509182269","184876545951272017641577791387436802943"],"threshold":0.9},"id":"CVE-2026-90714-7b57a6de","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"function":"unittest_scan","file":"src/cli/gravity.c"},"deprecated":false,"digest":{"function_hash":"292201698311220064713275658324930317299","length":1657},"id":"CVE-2026-90714-8bd653ed"},{"deprecated":false,"digest":{"function_hash":"273867842814167925731682929639642268846","length":339},"id":"CVE-2026-90714-99a7989a","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"is_directory"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_read"},"deprecated":false,"digest":{"function_hash":"311722921221243564247507039258533545568","length":703},"id":"CVE-2026-90714-a7a780c1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_exists"},"deprecated":false,"digest":{"function_hash":"261129316849645513005458879864720704733","length":203},"id":"CVE-2026-90714-adb71db4"},{"target":{"function":"gravity_vm_loadbuffer","file":"src/runtime/gravity_vm.c"},"deprecated":false,"digest":{"function_hash":"276554022861609927978807137165877858137","length":1591},"id":"CVE-2026-90714-b0d164fa","signature_type":"Function","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2"},{"id":"CVE-2026-90714-baf91a61","signature_type":"Line","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["171998522860799375329246083647297209069","202153836528375942826433514885113961422","49878170761193188891388360529417819454","41926036136238511553942967829525741728","186045587560834578138195199927629034997","331328434784006443528958675221319691820","96037272885285757275135768837691385498","74588932158989973984253638429125484683","9399635291382188694602848313726138654","287771819397513540801419301433258971687","308748575615950643470257055172674447810","81465575170926915188641506222405558807","32820429838223713709179410200939768144","160243854344577656418112476506045626539","30426429818791017290168596616054935164","338175142067738915091398713968528828192","79935986783588381145685434618977303713","206904988105558854209857039633328595961","150440060494602048113537811518148683060","50443550379712345800076736803138228044","268819806055924855904917929216125465","228552983236564788403058812132868542988","176878767200479338489901931820437686146","15159265763611550055316072406475918614","41433357737696350270533108331073017658","206401132703047742805718938859619776421","59832021658175235106953661090443940385","213810214108872669477168493498999140931","270467247810365354585805736930915789214","6290858756573692439742392728040033412","121839518022835460300587411390591683490","227908484603291776347802831733789446961","50310947663384982863885536925269563791","269544564613188023770437259094771039290","263199967309411238294028000887784428742","227410573654187210865998653840960011563","238264449871172835442701582923241534262","269544564613188023770437259094771039290","263199967309411238294028000887784428742","227410573654187210865998653840960011563"]}},{"target":{"file":"src/optionals/gravity_opt_file.c","function":"scan_directory"},"deprecated":false,"digest":{"length":1081,"function_hash":"281681127129311348374576764050549196354"},"id":"CVE-2026-90714-c67bb49c","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c"},{"deprecated":false,"digest":{"line_hashes":["16097657950372424063305007697436018387","247926387353832273300188727109329465540","158206771817149844540637642501730342802","182456322976153144258859614746250032211","217283093963858352796151779353445829795","313334659522679043914331839104409216944"],"threshold":0.9},"id":"CVE-2026-90714-cc011d12","signature_type":"Line","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/shared/gravity_hash.c"}},{"digest":{"function_hash":"104205694610765078440195808963915352138","length":1637},"id":"CVE-2026-90714-cda51e68","signature_type":"Function","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/utils/gravity_json.c","function":"new_value"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/9b337c3eae5833c3956bed1fc01c21c14fd443f2","target":{"file":"src/runtime/gravity_vm.c"},"deprecated":false,"digest":{"line_hashes":["340161048533349102914087807804839375316","72873538009311109627339426333430145696","99135888413257966937334747893697447955","134084983354428998460073680349100041728","159586743362532861130470524098379177253","74943574752321039966595534101731726931","251768748289236295781685899839760324282","271083593337661949427234726209174618982","210474806979786096555268083690897085720","328422654460974293740721542191578751879","235967592069422590557848669810756607883"],"threshold":0.9},"id":"CVE-2026-90714-dd85f387"},{"signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"directory_create"},"deprecated":false,"digest":{"function_hash":"112058358530405323953144945288920279378","length":199},"id":"CVE-2026-90714-eba4eba2","signature_type":"Function"},{"target":{"file":"src/utils/gravity_utils.c","function":"directory_init"},"deprecated":false,"digest":{"function_hash":"200016442785796770236119168003037320735","length":289},"id":"CVE-2026-90714-f0d18cf1","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c"},{"digest":{"function_hash":"157046498083475499583745470024774660993","length":157},"id":"CVE-2026-90714-fce92716","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_delete"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"directory_read_extend"},"deprecated":false,"digest":{"function_hash":"221356346687101137042958937155764747993","length":798},"id":"CVE-2026-90714-feff1751"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90714.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}