CyberRota Analysis
AI-GeneratedThe vulnerability in vm2 prior to version 3.11.6 allows attackers to bypass the buffer allocation limit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, enabling them to allocate arbitrary host memory. This can lead to memory exhaustion and out-of-memory conditions, potentially crashing the host process. Organizations using affected versions of vm2 should prioritize patching to mitigate the risk of denial-of-service attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.