CVE-2026-92947

10 CRITICALpublic exploit available

Published 2026-09-17 · Updated 2026-09-17

AI risk analysis

Summary: This flaw allows sandboxed code to access Node's shared Buffer pool, leading to potential data exposure and denial-of-service conditions.
Exploitability: Exploitation requires access to sandboxed code and knowledge of Buffer allocation patterns, making it moderately difficult.
Blast radius: If exploited, this could lead to sensitive data exposure and potential service disruption for affected applications.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to vm2 version 3.11.7 or later.

buffer-exposuredenial-of-servicenodejs

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Weaknesses

CWE-200

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.