CVE-2026-92947: vm2 before 3.11.7 Memory Disclosure via Buffer Pool
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.
Affected Software
Event History
Frequently Asked Questions
Which vm2 versions need remediation?
vm2 versions before 3.11.7 are affected. Upgrade to version 3.11.7 or later.
What level of attacker access is needed?
The CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction. The relevant exposure is an application that executes attacker-controlled code in a vm2 sandbox.
What can an attacker gain from successful exploitation?
Sandboxed code can acquire ArrayBuffers from small allocations and use them to read and write host-realm buffers. This can disclose sensitive host memory and may cause denial of service.