CVE-2026-40573

    Dashboard / Vulnerabilities / CVE-2026-40573

    CVE-2026-40573

    Published: 30 Oct 2026Last Modified: 5 Nov 2026

    Summary: NovumOS: Nova Interpreter Privilege Escalation

    Details: NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in `zig/nova/vm.zig` as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.

    References: https://github.com/MinecAnton209/NovumOS/tree/v0.25-beta.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40573.json, https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rq9v-wxp3-ffrr, https://nvd.nist.gov/vuln/detail/CVE-2026-40573, https://github.com/MinecAnton209/NovumOS/commit/ca3e7a6b4bcdcac23413d39ecf863b94e6a3a207

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -62b76bee493a7ca66918c79b0c9abb674977712b

    Affected versions

    v0.25-alpha.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-40573 | CVE-DB