Quick answers
- Is CVE-2026-40504 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40504 being exploited in the wild.
- How severe is CVE-2026-40504?
- Critical severity, with a CVSS score of 9.8, published 16 April 2026.
- Which products and versions are affected?
- Creolabs Gravity before 0.9.6.
- Is there a fix for CVE-2026-40504?
- A patch was published on 2026-04-14: Fix committed and version 0.9.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40504 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-40504?
- Check whether you run Creolabs Gravity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap-based buffer overflow exists in Creolabs Gravity before version 0.9.6 within the gravity_vm_exec function. The vulnerability is rooted in insufficient bounds checking in gravity_fiber_reassign(), where a large register window (often triggered by many string literals at global scope or deep recursion) can exceed the allocated stack capacity of a fiber. An attacker can exploit this by providing a specially crafted script that, when executed by the VM, writes out-of-bounds to corrupt heap metadata. This can lead to arbitrary code execution in the context of the host application. The issue was addressed in version 0.9.6 by implementing configurable fiber stack limits and improved stack growth validation.
Affected products
- Creolabs Gravity before 0.9.6
Timeline
- 2026-04-14: patched: Fix committed and version 0.9.6 released
- 2026-04-14: disclosed: Issue reported on GitHub by haiyang4
- 2026-04-16: advisory: NVD publication date