Critical Heap Overflow in Creolabs Gravity Exposes Arbitrary Code Execution

The National Vulnerability Database (NVD) recently published details on CVE-2026-40504, a critical heap buffer overflow vulnerability in Creolabs Gravity, specifically affecting versions prior to 0.9.6. This isn’t just a run-of-the-mill bug; we’re talking about a CVSS score of 9.8, which puts it squarely in the ‘drop everything and fix’ category.

According to the NVD, the flaw resides within the gravity_vm_exec function. Attackers can craft malicious scripts containing an excessive number of string literals at the global scope. The real kicker here is the insufficient bounds checking in gravity_fiber_reassign(), which can be leveraged to corrupt heap metadata. The end result? Arbitrary code execution in applications that evaluate untrusted scripts. This is the kind of vulnerability that keeps security pros up at night, as it offers a direct path to system compromise if exploited in the wild.