vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool
En bref
Sévérité
MEDIUM 6.9
EPSS
EPSS 0.39 % · centile 33 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
VulnCheck
Statut NVD
Deferred
Description
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.
