This vulnerability (CVE-2026-40504) affects Creolabs Gravity versions prior to 0.9.6. It is a heap-based buffer overflow caused by improper bounds checking in the gravity_vm_exec and gravity_fiber_reassign functions. Attackers can craft malicious scripts containing numerous string literals at the global scope to trigger out-of-bounds writes, corrupt heap metadata, and potentially execute arbitrary code. The CVSS 4.0 score is 9.3, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published yet.

If exploited, this vulnerability allows remote attackers to execute arbitrary code without authentication or user interaction by leveraging a heap buffer overflow in the script evaluation engine. This can compromise the confidentiality, integrity, and availability of affected systems running vulnerable versions of Creolabs Gravity. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid evaluating untrusted scripts with vulnerable versions of Creolabs Gravity. Monitor vendor channels for updates and apply patches promptly once available.