CVE-2026-92947

vm2 before 3.11.7 Memory Disclosure via Buffer Pool

En bref

Sévérité: CRITICAL 10.0
EPSS: EPSS 0.48 % · centile 41 (2026-10-27)
État: PUBLISHED
Publiée: 2026-09-17
Mise à jour: 2026-09-17
Attribuée par: VulnCheck
Statut NVD: Deferred

Description

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

Scores

Version	Score	Vecteur	Évalué par
CVSS 4.0	CRITICAL 10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L	VulnCheck
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L	VulnCheck
CVSS 4.0	CRITICAL 10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · disclosure@vulncheck.com (Secondary)
CVSS 3.1	CRITICAL 10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L	NVD · disclosure@vulncheck.com (Secondary)

Faiblesses (CWE)

CWE-200

Avis

GHSA-fcqc-726x-5wfc — vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Références européennes

ENISA EUVD · EUVD-2026-81596
GCVE · GCVE-0-2026-92947

Produits affectés

Produit	Versions
patriksimek · vm2	affected 0 < 3.11.7 ; unaffected 3.11.7

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD