Executive brief
Creolabs Gravity is a programming language and virtual machine used to embed scripting capabilities into applications. A security flaw allows a malicious script to bypass memory safety limits, potentially leading to a complete system takeover. This is particularly dangerous for applications that allow users to provide or run their own scripts, as it could result in unauthorized data access or service disruption.
Technical details
A heap-based buffer overflow exists in Creolabs Gravity before version 0.9.6 within the gravity_vm_exec function. The vulnerability is rooted in insufficient bounds checking in gravity_fiber_reassign(), where a large register window (often triggered by many string literals at global scope or deep recursion) can exceed the allocated stack capacity of a fiber. An attacker can exploit this by providing a specially crafted script that, when executed by the VM, writes out-of-bounds to corrupt heap metadata. This can lead to arbitrary code execution in the context of the host application. The issue was addressed in version 0.9.6 by implementing configurable fiber stack limits and improved stack growth validation.
Affected products
- Creolabs Gravity before 0.9.6
Timeline
- 2026-04-14: patched: Fix committed and version 0.9.6 released
- 2026-04-14: disclosed: Issue reported on GitHub by haiyang4
- 2026-04-16: advisory: NVD publication date