---
id: CVE-2026-92961
title: >-
  vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer,
  SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate
  arbitrary host memory
summary: >-
  vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer,
  SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate
  arbitrary host memory. Attackers can bypass the buffer allocation cap by using
  these V8 in…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: patriksimek
product: vm2
affected:
  - vm2 < 3.11.6
published: '2026-09-17'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T21:17:17.057'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92961'
references:
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/vm2-before-3.11.6-memory-exhaustion-dos-via-bufferalloclimit-bypass
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92961.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-92961'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-92961'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92961'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536046'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T16:28:41.600458Z'
epss: 0.00533
epssPercentile: 0.4261
ingestedAt: '2026-09-17T14:19:30.992Z'
---

## Overview

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, Self-service automation portal 2 · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-92961.json)