High severity · published Sep 17, 2026
CVE-2026-92961
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VM
vm2 · patriksimek
before 3.11.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92961
github.com
https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3
www.vulncheck.com
https://www.vulncheck.com/advisories/vm2-before-3.11.6-memory-exhaustion-dos-via-bufferalloclimit-bypass
More from vm2
10.0
CVE-2026-93606
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species
10.0
CVE-2026-93605
vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
10.0
CVE-2026-93603
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function
10.0
CVE-2026-92960
vm2 before 3.11.6 Process-wide State Exposure via os and dns
10.0
CVE-2026-92956
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming