CVE-2026-40504 is a critical heap buffer overflow vulnerability in Creolabs Gravity prior to version 0.9.6. The vulnerability exists in the gravity_vm_exec function, where processing scripts with numerous global string literals can cause out-of-bounds writes. Additionally, the gravity_fiber_reassign() function lacks sufficient bounds checking, enabling heap metadata corruption. Successful exploitation can result in arbitrary code execution within applications that run untrusted Gravity scripts.

An attacker can exploit this vulnerability remotely without authentication to execute arbitrary code on the affected system. This can lead to full compromise of applications embedding the vulnerable Gravity engine, potentially allowing control over the host environment. The CVSS 4.0 base score is 9.3, indicating critical severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid evaluating untrusted Gravity scripts or restrict script inputs to trusted sources. Monitor vendor channels for updates regarding patches or official mitigations.