CVE-2026-92961
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 17, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 17, 2026
Description
vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
vm2patriksimek |
|
References
- GitHub Security Advisory (GHSA-v836-6xw4-9cx3)vendor-advisory
- VulnCheck Advisory: vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.