CVE-2026-92947
vm2 before 3.11.7 Memory Disclosure via Buffer Pool
- State
- Published
- Severity
- 10.0 Critical
- Published
- Sep 17, 2026
- Updated
- Sep 17, 2026
- Reserved
- Sep 17, 2026
Description
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 10.0 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L | VulnCheck |
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L | VulnCheck |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
vm2patriksimek |
|
References
- GitHub Security Advisory (GHSA-fcqc-726x-5wfc)vendor-advisory
- VulnCheck Advisory: vm2 before 3.11.7 Memory Disclosure via Buffer Poolthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.