CVE-2026-92961 Details
Description
vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.
A denial-of-service vulnerability has been identified in vm2 versions prior to 3.11.6. The issue arises because the 'bufferAllocLimit' feature does not apply to 'ArrayBuffer', 'SharedArrayBuffer', and 'TypedArray' constructors. This oversight allows attackers to allocate excessive amounts of host memory, bypassing the intended limits and causing out-of-memory conditions that can terminate the host process. The vulnerability exploits the same underlying allocation path as the buffered methods that are capped, leading to similar memory usage without restriction.
Users can upgrade to vm2 version 3.11.6 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/vm2-before-3.11.6-memory-exhaustion-dos-via-bufferalloclimit-bypass | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vm2 | <= 3.11.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |