CVE-2026-92947CWE-200information-disclosure

CVE-2026-92947

Critical · published September 17, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
EPSS
0.00482 · 40.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-09-17T18:18Z
References (3)
https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc · [email protected]https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool · [email protected]https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 13:46Z
    vm2 before 3.11.7 Memory Disclosure via Buffer Pool
    cvelistv5