CVE-2026-92947
Last modified
CVE-2026-92947 is a critical-severity vulnerability rated 10/10 on the CVSS scale. vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service..
Description
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92947?
How severe is CVE-2026-92947?
How do I fix CVE-2026-92947?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92941vm2 versions from 3.11.3 before 3.11.7 expose the host tls m…10
- CVE-2026-92942vm2 before 3.11.7 (affected versions <= 3.11.6) does not enf…7.5
- CVE-2026-92943Improper validation of certificate with host mismatch in the…8.1
- CVE-2026-92944vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape …9.8
- CVE-2026-92945vm2 before 3.11.7 contains a module allowlist bypass vulnera…4.2
- CVE-2026-92946vm2 before 3.11.7 contains a remote code execution vulnerabi…10
- CVE-2026-92948vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM…9.9
- CVE-2026-92949vm2 versions from 3.9.6 before 3.11.7 fail to properly restr…4
- CVE-2026-9295A security flaw has been discovered in Edimax BR-6428NS 1.10…8.8
- CVE-2026-92950vm2 before 3.11.7 contains a sandbox escape vulnerability in…8.6
- CVE-2026-92951vm2 before 3.11.7 contains an incorrect authorization vulner…9.9
- CVE-2026-92952vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.…6.8
Are you affected by CVE-2026-92947?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST