{"id":"CVE-2026-92947","published":"2026-09-17T14:18:00.140","lastModified":"2026-09-17T16:18:34.667","description":"vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","cwes":["CWE-200"],"vendors":[],"products":[],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc","tags":[]},{"url":"https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool","tags":[]},{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc","tags":[]}],"exploitRefs":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc","tags":[]},{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc","tags":[]}],"hasPoc":true,"ai":{"summary":"This flaw allows sandboxed code to access Node's shared Buffer pool, leading to potential data exposure and denial-of-service conditions.","exploitability":"Exploitation requires access to sandboxed code and knowledge of Buffer allocation patterns, making it moderately difficult.","blast_radius":"If exploited, this could lead to sensitive data exposure and potential service disruption for affected applications.","remediation":"Upgrade to vm2 version 3.11.7 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["buffer-exposure","denial-of-service","nodejs"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-28T08:57:44.410Z"}}