{"id":"CVE-2026-90716","summary":"marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds","details":"A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.","modified":"2026-09-17T08:06:08.898173Z","published":"2026-09-14T12:45:10.603Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90716.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0.9.1"},{"last_affected":"0.9.1"},{"introduced":"0.9.2"},{"last_affected":"0.9.2"},{"introduced":"0.9.3"},{"last_affected":"0.9.3"},{"introduced":"0.9.4"},{"last_affected":"0.9.4"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB","cwe_ids":["CWE-119","CWE-125"]},"references":[{"type":"WEB","url":"https://github.com/marcobambini/gravity/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90716.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90716"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90716"},{"type":"ADVISORY","url":"https://vuldb.com/submit/919190"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403270"},{"type":"REPORT","url":"https://github.com/marcobambini/gravity/issues/446"},{"type":"REPORT","url":"https://vuldb.com/vuln/403270/cti"},{"type":"FIX","url":"https://github.com/marcobambini/gravity/pull/449"},{"type":"FIX","url":"https://github.com/marcobambini/gravity/releases/tag/0.9.8"},{"type":"FIX","url":"https://github.com/sthagen/marcobambini-gravity/commit/1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/marcobambini/gravity","events":[{"introduced":"9fccc47b8bd43ec1ac8a2868b938e2d64c2806aa"},{"fixed":"40a26f2c81051af00544e7a667ff5b1084b9937c"}],"database_specific":{"extracted_events":[{"introduced":"0.9.0"},{"last_affected":"0.9.0"},{"introduced":"0.9.5"},{"last_affected":"0.9.5"},{"introduced":"0.9.6"},{"last_affected":"0.9.6"},{"introduced":"0.9.7"},{"last_affected":"0.9.7"}],"source":["AFFECTED_FIELD","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/sthagen/marcobambini-gravity","events":[{"introduced":"0"},{"fixed":"1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6"}],"database_specific":{"source":"REFERENCES"}}],"versions":["0.9.0","0.9.5","0.9.6","0.9.7","v0.9.5","0.7.8","0.7.7","0.7.6","0.7.5","0.7.4","0.7.0","0.6.9","0.6.7","0.6.6","0.6.5","0.6.4","0.6.3","0.6.1","0.6.0","0.5.9","0.5.8","0.5.6","0.5.5","0.5.4","0.5.1","0.5.0","0.4.9","0.4.8","0.4.7","0.4.5","0.4.4","0.4.3","0.4.2","0.4.1","0.4.0","0.3.8","0.3.7","0.3.6","0.3.5","0.3.0","0.2.8"],"database_specific":{"vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_buildpath"},"deprecated":false,"digest":{"function_hash":"280251523899474841246980219471860752856","length":512},"id":"CVE-2026-90716-30b6a0fc"},{"source":"https://github.com/sthagen/marcobambini-gravity/commit/1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6","target":{"file":"src/compiler/gravity_parser.c"},"deprecated":false,"digest":{"line_hashes":["286270386751665454135213334438129585600","140001838782457017702217255776231852177","227105297687767367979878402241145777639","128199344330285889627758195086666031752"],"threshold":0.9},"id":"CVE-2026-90716-3be71616","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"175537896541162334888258530959801595990","length":350},"id":"CVE-2026-90716-3f8305fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_size"}},{"target":{"file":"src/optionals/gravity_opt_file.c"},"deprecated":false,"digest":{"line_hashes":["96651144436907160232074504838707307494","213230403875323693952521923652550117896","324125323960775487364419528686619175142","304731589433403457228151585164611957017"],"threshold":0.9},"id":"CVE-2026-90716-5a7d172e","signature_type":"Line","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"directory_read"},"deprecated":false,"digest":{"function_hash":"21043015588810320897173356749066040767","length":736},"id":"CVE-2026-90716-64f51aa0"},{"target":{"file":"src/cli/gravity.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["222311800301159257551802957815531412578","227891431396206675631259796725117238812","239800484188899712317325038789509182269","184876545951272017641577791387436802943"]},"id":"CVE-2026-90716-7b57a6de","signature_type":"Line","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c"},{"deprecated":false,"digest":{"function_hash":"64841354440779097483328917388218371177","length":1511},"id":"CVE-2026-90716-7d74b18d","signature_type":"Function","signature_version":"v1","source":"https://github.com/sthagen/marcobambini-gravity/commit/1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6","target":{"file":"src/compiler/gravity_parser.c","function":"parse_number_expression"}},{"source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/cli/gravity.c","function":"unittest_scan"},"deprecated":false,"digest":{"function_hash":"292201698311220064713275658324930317299","length":1657},"id":"CVE-2026-90716-8bd653ed","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"is_directory"},"deprecated":false,"digest":{"function_hash":"273867842814167925731682929639642268846","length":339},"id":"CVE-2026-90716-99a7989a"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_read"},"deprecated":false,"digest":{"length":703,"function_hash":"311722921221243564247507039258533545568"},"id":"CVE-2026-90716-a7a780c1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_exists"},"deprecated":false,"digest":{"function_hash":"261129316849645513005458879864720704733","length":203},"id":"CVE-2026-90716-adb71db4"},{"deprecated":false,"digest":{"line_hashes":["171998522860799375329246083647297209069","202153836528375942826433514885113961422","49878170761193188891388360529417819454","41926036136238511553942967829525741728","186045587560834578138195199927629034997","331328434784006443528958675221319691820","96037272885285757275135768837691385498","74588932158989973984253638429125484683","9399635291382188694602848313726138654","287771819397513540801419301433258971687","308748575615950643470257055172674447810","81465575170926915188641506222405558807","32820429838223713709179410200939768144","160243854344577656418112476506045626539","30426429818791017290168596616054935164","338175142067738915091398713968528828192","79935986783588381145685434618977303713","206904988105558854209857039633328595961","150440060494602048113537811518148683060","50443550379712345800076736803138228044","268819806055924855904917929216125465","228552983236564788403058812132868542988","176878767200479338489901931820437686146","15159265763611550055316072406475918614","41433357737696350270533108331073017658","206401132703047742805718938859619776421","59832021658175235106953661090443940385","213810214108872669477168493498999140931","270467247810365354585805736930915789214","6290858756573692439742392728040033412","121839518022835460300587411390591683490","227908484603291776347802831733789446961","50310947663384982863885536925269563791","269544564613188023770437259094771039290","263199967309411238294028000887784428742","227410573654187210865998653840960011563","238264449871172835442701582923241534262","269544564613188023770437259094771039290","263199967309411238294028000887784428742","227410573654187210865998653840960011563"],"threshold":0.9},"id":"CVE-2026-90716-baf91a61","signature_type":"Line","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c"}},{"digest":{"function_hash":"281681127129311348374576764050549196354","length":1081},"id":"CVE-2026-90716-c67bb49c","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/optionals/gravity_opt_file.c","function":"scan_directory"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"directory_create"},"deprecated":false,"digest":{"function_hash":"112058358530405323953144945288920279378","length":199},"id":"CVE-2026-90716-eba4eba2","signature_type":"Function"},{"target":{"file":"src/utils/gravity_utils.c","function":"directory_init"},"deprecated":false,"digest":{"function_hash":"200016442785796770236119168003037320735","length":289},"id":"CVE-2026-90716-f0d18cf1","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c"},{"id":"CVE-2026-90716-fce92716","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"file_delete"},"deprecated":false,"digest":{"function_hash":"157046498083475499583745470024774660993","length":157}},{"digest":{"function_hash":"221356346687101137042958937155764747993","length":798},"id":"CVE-2026-90716-feff1751","signature_type":"Function","signature_version":"v1","source":"https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c","target":{"file":"src/utils/gravity_utils.c","function":"directory_read_extend"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90716.json","vanir_signatures_modified":"2026-09-17T08:06:08Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}