Local Code Execution Vulnerability in NovumOS Operating System by MinecAnton209

CVE-2026-40573

What is CVE-2026-40573?

NovumOS, a custom 32-bit operating system developed in Zig and x86 Assembly, has a significant vulnerability due to the Nova interpreter operating in Ring 0 with unrestricted kernel-memory access. This issue arises when a local user loads a malicious .nv script through the shell, allowing them to execute code with kernel privileges without undergoing security checks. The vulnerability specifically affects VM initialization as noted in zig/nova/vm.zig, where script execution lacks isolation in a protected Ring 3 privilege domain. Users should upgrade to version 0.25-beta.1 to mitigate this security threat.

References