VDB
CVE-2026-92961
CVE-2026-92961
PUBLISHED
CVSS 8.7 HIGH
Reported by VulnCheck · Published September 17, 2026
vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.
Risk Scores
CVSS 4.0
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| patriksimek | vm2 | 0, 3.11.6 |
| patriksimek | vm2 | 0, 3.11.6 |
Timeline
- Sep 17, 2026 Coalition ESS Score
- Sep 17, 2026 CVE Published
- Sep 18, 2026 EPSS Score
- Sep 21, 2026 EPSS Score
- Sep 21, 2026 CVE Updated
- Sep 22, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 9, 2026 EPSS Score
References
- GitHub Security Advisory (GHSA-v836-6xw4-9cx3) vendor-advisory
- VulnCheck Advisory: vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass third-party-advisory