CVE-2026-90716

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90716
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90716.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90716
Published
2026-09-14T12:45:10Z
Modified
2026-10-28T11:19:34Z
Severity
  • 2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds
Details

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of the file src/compiler/gravity_parser.c of the component Number Parser. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 0.9.8 will fix this issue. The patch is named 1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6. It is recommended to upgrade the affected component.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-119",
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90716.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "0.9.1"
                        },
                        {
                            "last_affected":  "0.9.1"
                        },
                        {
                            "introduced":  "0.9.2"
                        },
                        {
                            "last_affected":  "0.9.2"
                        },
                        {
                            "introduced":  "0.9.3"
                        },
                        {
                            "last_affected":  "0.9.3"
                        },
                        {
                            "introduced":  "0.9.4"
                        },
                        {
                            "last_affected":  "0.9.4"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/marcobambini/gravity

Affected ranges

Type
GIT
Repo
https://github.com/marcobambini/gravity
Events
Introduced
9fccc47b8bd43ec1ac8a2868b938e2d64c2806aa
Fixed
40a26f2c81051af00544e7a667ff5b1084b9937c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.9.0"
                },
                {
                    "last_affected":  "0.9.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "0.9.5"
                },
                {
                    "last_affected":  "0.9.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "0.9.6"
                },
                {
                    "last_affected":  "0.9.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "introduced":  "0.9.7"
                },
                {
                    "last_affected":  "0.9.7"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "original_tag":  "0.9.8",
            "range":  [
                {
                    "fixed":  "40a26f2c81051af00544e7a667ff5b1084b9937c"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}
Type
GIT
Repo
https://github.com/sthagen/marcobambini-gravity
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "fixed":  "1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.2.8
0.3.0
0.3.5
0.3.6
0.3.7
0.3.8
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.4
0.5.5
0.5.6
0.5.8
0.5.9
0.6.0
0.6.1
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.9
0.7.0
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.9.0
0.9.5
0.9.6
0.9.7
v0.*
v0.9.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90716.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "280251523899474841246980219471860752856",
            "length":  512
        },
        "id":  "CVE-2026-90716-30b6a0fc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "file_buildpath"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "286270386751665454135213334438129585600",
                "140001838782457017702217255776231852177",
                "227105297687767367979878402241145777639",
                "128199344330285889627758195086666031752"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-90716-3be71616",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/sthagen/marcobambini-gravity/commit/1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6",
        "target":  {
            "file":  "src/compiler/gravity_parser.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "175537896541162334888258530959801595990",
            "length":  350
        },
        "id":  "CVE-2026-90716-3f8305fd",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "file_size"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "96651144436907160232074504838707307494",
                "213230403875323693952521923652550117896",
                "324125323960775487364419528686619175142",
                "304731589433403457228151585164611957017"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-90716-5a7d172e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/optionals/gravity_opt_file.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "21043015588810320897173356749066040767",
            "length":  736
        },
        "id":  "CVE-2026-90716-64f51aa0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "directory_read"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "222311800301159257551802957815531412578",
                "227891431396206675631259796725117238812",
                "239800484188899712317325038789509182269",
                "184876545951272017641577791387436802943"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-90716-7b57a6de",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/cli/gravity.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "64841354440779097483328917388218371177",
            "length":  1511
        },
        "id":  "CVE-2026-90716-7d74b18d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/sthagen/marcobambini-gravity/commit/1b9bbf3ad5749e2a3434e6ad073c6e93c24207b6",
        "target":  {
            "file":  "src/compiler/gravity_parser.c",
            "function":  "parse_number_expression"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "292201698311220064713275658324930317299",
            "length":  1657
        },
        "id":  "CVE-2026-90716-8bd653ed",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/cli/gravity.c",
            "function":  "unittest_scan"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "273867842814167925731682929639642268846",
            "length":  339
        },
        "id":  "CVE-2026-90716-99a7989a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "is_directory"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "311722921221243564247507039258533545568",
            "length":  703
        },
        "id":  "CVE-2026-90716-a7a780c1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "file_read"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "261129316849645513005458879864720704733",
            "length":  203
        },
        "id":  "CVE-2026-90716-adb71db4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "file_exists"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "171998522860799375329246083647297209069",
                "202153836528375942826433514885113961422",
                "49878170761193188891388360529417819454",
                "41926036136238511553942967829525741728",
                "186045587560834578138195199927629034997",
                "331328434784006443528958675221319691820",
                "96037272885285757275135768837691385498",
                "74588932158989973984253638429125484683",
                "9399635291382188694602848313726138654",
                "287771819397513540801419301433258971687",
                "308748575615950643470257055172674447810",
                "81465575170926915188641506222405558807",
                "32820429838223713709179410200939768144",
                "160243854344577656418112476506045626539",
                "30426429818791017290168596616054935164",
                "338175142067738915091398713968528828192",
                "79935986783588381145685434618977303713",
                "206904988105558854209857039633328595961",
                "150440060494602048113537811518148683060",
                "50443550379712345800076736803138228044",
                "268819806055924855904917929216125465",
                "228552983236564788403058812132868542988",
                "176878767200479338489901931820437686146",
                "15159265763611550055316072406475918614",
                "41433357737696350270533108331073017658",
                "206401132703047742805718938859619776421",
                "59832021658175235106953661090443940385",
                "213810214108872669477168493498999140931",
                "270467247810365354585805736930915789214",
                "6290858756573692439742392728040033412",
                "121839518022835460300587411390591683490",
                "227908484603291776347802831733789446961",
                "50310947663384982863885536925269563791",
                "269544564613188023770437259094771039290",
                "263199967309411238294028000887784428742",
                "227410573654187210865998653840960011563",
                "238264449871172835442701582923241534262",
                "269544564613188023770437259094771039290",
                "263199967309411238294028000887784428742",
                "227410573654187210865998653840960011563"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-90716-baf91a61",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "281681127129311348374576764050549196354",
            "length":  1081
        },
        "id":  "CVE-2026-90716-c67bb49c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/optionals/gravity_opt_file.c",
            "function":  "scan_directory"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "112058358530405323953144945288920279378",
            "length":  199
        },
        "id":  "CVE-2026-90716-eba4eba2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "directory_create"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "200016442785796770236119168003037320735",
            "length":  289
        },
        "id":  "CVE-2026-90716-f0d18cf1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "directory_init"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "157046498083475499583745470024774660993",
            "length":  157
        },
        "id":  "CVE-2026-90716-fce92716",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "file_delete"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "221356346687101137042958937155764747993",
            "length":  798
        },
        "id":  "CVE-2026-90716-feff1751",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/marcobambini/gravity/commit/40a26f2c81051af00544e7a667ff5b1084b9937c",
        "target":  {
            "file":  "src/utils/gravity_utils.c",
            "function":  "directory_read_extend"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:19:34Z"