This vulnerability involves an out-of-bounds read in the Number Parser component of marcobambini Gravity, specifically in the parse_number_expression function of src/compiler/gravity_parser.c. Versions 0.9.0 through 0.9.7 are affected. The vulnerability can be exploited remotely without privileges or user interaction, potentially allowing an attacker to read memory beyond intended boundaries. The issue is fixed in version 0.9.8, with the patch identified by commit 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. A public exploit exists, increasing the risk of exploitation.

Successful exploitation of this vulnerability could lead to out-of-bounds memory reads, which may result in information disclosure or application instability. The vulnerability is remotely exploitable without privileges or user interaction, increasing its risk. The CVSS 4.0 base score is 5.1 (medium severity), reflecting the moderate impact and ease of exploitation.

A fix is available by upgrading marcobambini Gravity to version 0.9.8. It is recommended to apply this update promptly to remediate the vulnerability. No additional mitigation steps are indicated beyond applying the official patch.