CVE-2026-92953

Summary

This flaw allows attackers to modify host TypedArray and ArrayBuffer prototypes, leading to potential host-created typed arrays observing attacker-controlled properties. This can compromise data integrity and security.

Exploitability

Exploitation is relatively straightforward given the preconditions of running the affected vm2 version and having access to prototype-walking primitives.

Blast radius

If exploited, this could lead to significant data corruption and security breaches, impacting any application relying on host-created typed arrays.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to vm2 version 3.11.8 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.