{"id":"CVE-2026-92947","aliases":["CLSA-2026-1791278844","CLSA-2026-1791282867","EUVD-2026-81596","GHSA-fcqc-726x-5wfc","GHSA-x5qg-8pq6-39h6","ROOT-APP-NPM-CVE-2026-92947"],"status":"published","title":"vm2 before 3.11.7 Memory Disclosure via Buffer Pool","description":"vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00482,"percentile":0.41903,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-653","CWE-668"],"published":"2026-09-17T13:46:08Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"npm","package":"vm2","fixed_in":["3.11.7"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"vm2","fixed_in":["3.11.6-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/vm2","fixed_in":["3.11.6-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.11.6"},{"fixed":"3.11.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.5-tuxcare.0"},{"fixed":"3.11.5-tuxcare.4"}]}],"versions":["3.11.5","3.11.5-tuxcare.1","3.11.5-tuxcare.2","3.11.5-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.0-tuxcare.0"},{"fixed":"3.10.0-tuxcare.4"}]}],"versions":["3.10.0","3.10.0-tuxcare.1","3.10.0-tuxcare.2","3.10.0-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"vm2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.7"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/vm2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.6-root.io.1"}]}]}],"products":[{"vendor":"patriksimek","product":"vm2"}],"references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc","tags":["vendor-advisory","exploit","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool","tags":["third-party-advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92947","tags":["advisory"]},{"url":"https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089","tags":["web"]},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fcqc-726x-5wfc"},{"url":"https://github.com/advisories/GHSA-x5qg-8pq6-39h6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92947.json","tags":["advisory"]},{"url":"https://github.com/patriksimek/vm2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-92947","title":"vm2 before 3.11.7 Memory Disclosure via Buffer Pool","description":"vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.","status":"published","published":"2026-09-17T13:46:08.167Z","modified":"2026-09-17T15:47:14.117Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","level":"critical","assessor":"cna"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:48:24.536396Z"}],"euvd":[{"id":"EUVD-2026-81596","description":"vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.","status":"published","published":"2026-09-17T13:46:08Z","modified":"2026-09-17T15:47:14Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","level":"critical"}],"updated_at":"2026-11-02T17:28:11.273554Z"}],"ghsa":[{"id":"GHSA-fcqc-726x-5wfc","title":"vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool","description":"### Summary\nSandboxed code is able to disclose host memory used by small allocations by `Buffer.from`, `Buffer.concat`.\n\n### Details\nvm2 exposes `Buffer` object to sandboxed code by default. Small [`Buffer` allocations](https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize) (for example, [Buffer.allocUnsafe()](https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize), [Buffer.from(array)](https://nodejs.org/api/buffer.html#static-method-bufferfromarray), [Buffer.from(string)](https://nodejs.org/api/buffer.html#static-method-bufferfromstring-encoding), and [Buffer.concat()](https://nodejs.org/api/buffer.html#static-method-bufferconcatlist-totallength)) use the same Buffer pool, which is shared with the sandbox. This allows sandboxed code to disclose host memory used by the functions listed above.\n\n### PoC\nTested against `vm2@3.11.5` in the node REPL.\n```javascript\nBuffer.from('host-memory-should-not-leak-to-sandbox')\nnew (require('vm2').VM)().run(`Buffer.from(Buffer.from([0]).buffer, 0, Buffer.from([0]).buffer.byteLength).toString('ascii')`)\n```\n\n\u003cimg width=\"1044\" height=\"104\" alt=\"Screenshot 2026-07-23 at 17 54 15\" src=\"https://github.com/user-attachments/assets/987b860c-6702-4818-bfaa-c77919c777e5\" /\u003e\n\n### Impact\nSince sandbox acquires an ArrayBuffer that is used by the host, it can disclose sensitive data going through functions mentioned above and even write to these buffers, which can lead to sensitive data exposure and potentially denial-of-service.","status":"published","published":"2026-10-05T22:34:35Z","modified":"2026-10-05T22:34:36Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-200","CWE-653","CWE-668"],"updated_at":"2026-11-02T14:41:25.889593Z"},{"id":"GHSA-x5qg-8pq6-39h6","title":"Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.","status":"withdrawn","published":"2026-09-17T15:32:15Z","modified":"2026-10-05T22:34:31Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:41:25.889593Z"}],"nvd":[{"id":"CVE-2026-92947","description":"vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.","status":"published","published":"2026-09-17T14:18:00.14Z","modified":"2026-09-17T16:18:34.667Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:49.013904Z"}],"osv":[{"id":"CVE-2026-92947","title":"vm2 before 3.11.7 Memory Disclosure via Buffer Pool","description":"vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.","status":"published","published":"2026-09-17T13:46:08.167Z","modified":"2026-10-28T02:31:07.514522982Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L","level":"critical"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:20.588039Z"},{"id":"GHSA-fcqc-726x-5wfc","title":"vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool","description":"### Summary\nSandboxed code is able to disclose host memory used by small allocations by `Buffer.from`, `Buffer.concat`.\n\n### Details\nvm2 exposes `Buffer` object to sandboxed code by default. Small [`Buffer` allocations](https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize) (for example, [Buffer.allocUnsafe()](https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize), [Buffer.from(array)](https://nodejs.org/api/buffer.html#static-method-bufferfromarray), [Buffer.from(string)](https://nodejs.org/api/buffer.html#static-method-bufferfromstring-encoding), and [Buffer.concat()](https://nodejs.org/api/buffer.html#static-method-bufferconcatlist-totallength)) use the same Buffer pool, which is shared with the sandbox. This allows sandboxed code to disclose host memory used by the functions listed above.\n\n### PoC\nTested against `vm2@3.11.5` in the node REPL.\n```javascript\nBuffer.from('host-memory-should-not-leak-to-sandbox')\nnew (require('vm2').VM)().run(`Buffer.from(Buffer.from([0]).buffer, 0, Buffer.from([0]).buffer.byteLength).toString('ascii')`)\n```\n\n\u003cimg width=\"1044\" height=\"104\" alt=\"Screenshot 2026-07-23 at 17 54 15\" src=\"https://github.com/user-attachments/assets/987b860c-6702-4818-bfaa-c77919c777e5\" /\u003e\n\n### Impact\nSince sandbox acquires an ArrayBuffer that is used by the host, it can disclose sensitive data going through functions mentioned above and even write to these buffers, which can lead to sensitive data exposure and potentially denial-of-service.","status":"published","published":"2026-10-05T22:34:35Z","modified":"2026-10-05T22:45:05.487849035Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-200","CWE-653","CWE-668"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"GHSA-x5qg-8pq6-39h6","title":"Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.","status":"withdrawn","published":"2026-09-17T15:32:15Z","modified":"2026-10-05T22:45:05.544091563Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"CLSA-2026-1791278844","title":"TuxCare security update for vm2 (5 CVEs)","description":"TuxCare rebuilt vm2 to address 5 CVEs. Fixed in 3.11.5-tuxcare.4.","status":"published","published":"2026-10-06T09:27:24Z","modified":"2026-10-15T09:47:35.516015141Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791282867","title":"TuxCare security update for vm2 (3 CVEs)","description":"TuxCare rebuilt vm2 to address 3 CVEs. Fixed in 3.10.0-tuxcare.4.","status":"published","published":"2026-10-06T10:34:27Z","modified":"2026-10-15T09:47:35.588781398Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"ROOT-APP-NPM-CVE-2026-92947","title":"CVE-2026-92947 in vm2 - Patched by Root","description":"Root has patched CVE-2026-92947 in the vm2 package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-19T07:16:29Z","modified":"2026-10-19T08:15:06.368601759Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}