Buffer Memory Disclosure Vulnerability in vm2 Affected by Node's zlib Module

CVE-2026-100723

What is CVE-2026-100723?

The vm2 library before version 3.12.2 fails to enforce buffer ownership invariants, leading to potential memory disclosure and corruption risks. Specifically, when Node's zlib module is exposed through NodeVM's builtin allowlist, it may return a Buffer that has shared backing storage. This allows untrusted guest code to create access to unrelated memory within the host realm. Consequently, attackers can exploit this flaw to read or alter memory designed for other applications, compromising the security of the host environment itself.

References