CVE-2026-100723

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

• CWE-200

• https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089
• https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09
• https://github.com/patriksimek/vm2/security/advisories/GHSA-489w-w794-jq94
• https://www.vulncheck.com/advisories/vm2-before-3.12.2-memory-disclosure-via-zlib-buffer-pool

Published

Sep 27, 2026

Last Modified

Sep 27, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100718Froxlor through 2.3.10 does not enforce the mail.allow_exter…7.1
• CVE-2026-100719Froxlor versions before 2.3.12 contain a credential disclosu…6.5
• CVE-2026-10072DreamMaker developed by Interinfo has an Arbitrary File Uplo…8.6
• CVE-2026-100720Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-s…8.7
• CVE-2026-100721vm2 before 3.12.2 contains an authorization bypass in the No…9
• CVE-2026-100722vm2 before 3.12.2 does not apply host-side Promise rejection…6.8
• CVE-2026-100724http4k (Maven package org.http4k:http4k-core) before 6.49.0.…5.4
• CVE-2026-100725http4k (Maven artifact org.http4k:http4k-core) before 6.48.0…6.5
• CVE-2026-10073DreamMaker developed by Interinfo has an Arbitrary File Read…8.7
• CVE-2026-100739A vulnerability was detected in mathurvishal CloudClassroom-…7.3
• CVE-2026-10074DreamMaker developed by Interinfo has an Arbitrary File Read…6.9
• CVE-2026-100740A vulnerability was detected in D-Link DIR-895L A1_102b07. I…9.9