vm2 before 3.11.7 Memory Disclosure via Buffer Pool

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92947 · Microsoft / collected KEV context

EUVD-2026-81596

GHSA-x5qg-8pq6-39h6

GHSA-fcqc-726x-5wfc

cve-program · CVE-2026-92947

• https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool

euvd · EUVD-2026-81596

• https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool

nvd · CVE-2026-92947

• https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool

osv · GHSA-fcqc-726x-5wfc

• https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
• https://nvd.nist.gov/vuln/detail/CVE-2026-92947
• https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool

osv · GHSA-x5qg-8pq6-39h6

• https://github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
• https://nvd.nist.gov/vuln/detail/CVE-2026-92947
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool

• vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring Arra… · Advisory content revised · 1 Nov 2026