CVE-2026-90714— marcobambini Gravity JSON parser gravity_json.c memory corruption
Quick assessment
Affected
marcobambini Gravity
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 marcobambini 的 Gravity 0.9.7 及更早版本中发现了一个安全漏洞。受影响的组件是 JSON 解析器中 文件里的某个未知函数。该缺陷会导致内存破坏（memory corruption）。攻击者可以从远程触发此漏洞，且利用该漏洞的攻击方法（exploit）已公开，可能被用于发起攻击。 解决方案： 升级到 0.9.8 版本即可解决该问题。相关补丁的提交哈希为 。建议将受影响的组件升级至最新版本。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90714
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
marcobambini Gravity JSON parser gravity_json.c memory corruption
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravity_json.c of the component JSON parser. This manipulation causes memory corruption. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.8 is sufficient to resolve this issue. Patch name: 9b337c3eae5833c3956bed1fc01c21c14fd443f2. It is suggested to upgrade the affected component.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
内存缓冲区边界内操作的限制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| marcobambini | Gravity | 0.9.0 |
cpe:2.3:a:marcobambini:gravity:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-90714
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90714
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-90714 (1)
Vendor Pages for CVE-2026-90714 (1)
Other References for CVE-2026-90714 (1)
Same Patch Batch · marcobambini · 2026-09-14 · 3 CVEs total
| CVE-2026-90715 | 7.3 HIGH | marcobambini Gravity udp json-parser gravity_json.c integer overflow |
| CVE-2026-90716 | 5.5 MEDIUM | marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds |
IV. Related Vulnerabilities
V. Comments for CVE-2026-90714
No comments yet