CVE-2026-92947

critical · 10

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

CVSS

—

EPSS (exploit prob.)

—

EPSS percentile

2026-09-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-200

References

https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool
https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-92947