by Kastro
Paper/Archive/CVE-2026-92947

CVE-2026-92947

patriksimek vm2 — vm2 before 3.11.7 Memory Disclosure via Buffer Pool

EPSS 0.5%public exploitCVSS 10.0
critical.is priorityof 100
48
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 41.6.416 × 208.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

Affected

ProductAffectedFixed inSource
vm2< 3.11.73.11.7CNA

Scores by source

VulnCheck (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
VulnCheck (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfcwriteupvulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool