CVE-2026-40504 marcobambini CVE debrief

Who should care

Developers and users of Creolabs Gravity, especially those who evaluate untrusted scripts, should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 0.9.6 or later, and implementing additional security measures such as bounds checking and input validation.

Technical summary

The vulnerability is caused by insufficient bounds checking in the gravity_vm_exec function, which allows attackers to write out-of-bounds memory by crafting scripts with many string literals at global scope. Attackers can exploit this vulnerability to corrupt heap metadata and achieve arbitrary code execution in applications that evaluate untrusted scripts. The vulnerability is exacerbated by the fact that the gravity_fiber_reassign function does not properly check the bounds of the heap, allowing attackers to write arbitrary data to the heap.

Defensive priority

High

Recommended defensive actions

• Upgrade to Creolabs Gravity version 0.9.6 or later
• Implement additional security measures such as bounds checking and input validation
• Use secure coding practices when evaluating untrusted scripts
• Monitor for suspicious activity and implement logging and auditing mechanisms
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-04-16T02:16:11.693Z and was last modified on 2026-07-14T21:16:48.270Z. The NVD entry is currently Deferred. The vulnerability was reported by Vulncheck and has been publicly disclosed.

Official resources