CVE-2026-92961: patriksimek vm2, отказ на услуга

Описание

Оригинално описание

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.

Засегнати продукти

• patriksimek vm2: преди 3.11.6; 3.11.6

Вид слабост

• CWE-770 Allocation of Resources Without Limits or Throttling

История

Други уязвимости в patriksimek vm2

• 7.5CVE-2026-100723
• 8.9CVE-2026-100722
• 9.5CVE-2026-100721
• 10.0CVE-2026-93606
• 10.0CVE-2026-93605

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-92961
• https://nvd.nist.gov/vuln/detail/CVE-2026-92961
• https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3
• https://www.vulncheck.com/advisories/vm2-before-3.11.6-memory-exhaustion-dos-via-bufferalloclimit-bypass