NPM: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

🗓️ 05 Oct 2026 22:34:35Reported by PatchstackType

Sandboxed code in npm vm2 can read and write host-realm memory via shared Buffer pool.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerabilities of the `Buffer.from()` and `Buffer.concat()` functions in the `vm2` library from the NPM package manager allow a malicious actor to gain unauthorized access to protected information and cause service failures.	21 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-92947	17 Sep 202616:09	–	circl
CVE	CVE-2026-92947	17 Sep 202613:46	–	cve
Cvelist	CVE-2026-92947 vm2 before 3.11.7 Memory Disclosure via Buffer Pool	17 Sep 202613:46	–	cvelist
EUVD	EUVD-2026-81596	5 Oct 202622:34	–	euvd
Github Security Blog	vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool	5 Oct 202622:34	–	github
Github Security Blog	Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool	17 Sep 202615:32	–	github
NVD	CVE-2026-92947	17 Sep 202614:18	–	nvd
Positive Technologies	PT-2026-94318	25 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-92947: Exposure of Sensitive Information to an Unauthorized Actor	17 Sep 202600:00	–	rapid7

Vulners

Node

npm vm2Range≤3.11.6

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-92947
github	www.github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089
github	www.github.com/patriksimek/vm2/releases/tag/v3.11.7
vulncheck	www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool
github	www.github.com/advisories/GHSA-fcqc-726x-5wfc

05 Oct 2026 22:34Current

5.9Medium risk

Vulners AI Score5.9

CVSS 410

CVSS 3.110

EPSS0.00482

SSVC