← Back to the live CVE advisory feed

CVE-2026-100723: Product identification pending

Severity

6.9 (MEDIUM)

Affected versions

Before 3.12.2

Fixed version

3.12.2

Patch status

Patched

Published

2026-09-27T02:17:19.373

Modified

2026-09-27T02:17:20.553

Why it matters

Vulnerability requiring standard triage and vendor validation.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Compare installed versions against the affected version range in the advisory.

Technical summary

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.

View the official NVD record for CVE-2026-100723

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.