Vulnerability Description
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
- https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buf
- https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
FAQ
What is CVE-2026-92947?
CVE-2026-92947 is a vulnerability with a CVSS score of 10.0 (CRITICAL). vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write...
How severe is CVE-2026-92947?
CVE-2026-92947 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-92947?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.