CVE-2026-23762

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23762", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-15T18:42:20.939Z", "datePublished": "2026-01-22T16:17:31.516Z", "dateUpdated": "2026-05-14T02:09:26.792Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter (Standard)", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "1.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter Banana", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "2.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter Potato", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "3.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbmatrixvaio64*_win10.sys"], "platforms": ["Windows"], "product": "Matrix", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "1.0.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbmatrixvaio64*_win10.sys"], "platforms": ["Windows"], "product": "Matrix Coconut", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "2.0.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:twistedmatrix:twistedweb:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.0.2.2"}]}]}], "credits": [{"lang": "en", "type": "finder", "value": "Klaus Hahnenkamp"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers map non-paged pool memory into user space via MmMapLockedPagesSpecifyCache using UserMode access without proper exception handling. If the mapping fails, such as when a process has exhausted available virtual address space, MmMapLockedPagesSpecifyCache raises an exception that is not caught, causing a kernel crash (BSoD), typically SYSTEM_SERVICE_EXCEPTION with STATUS_NO_MEMORY. This flaw allows a local unprivileged user to trigger a denial-of-service on affected Windows systems."}], "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers map non-paged pool memory into user space via MmMapLockedPagesSpecifyCache using UserMode access without proper exception handling. If the mapping fails, such as when a process has exhausted available virtual address space, MmMapLockedPagesSpecifyCache raises an exception that is not caught, causing a kernel crash (BSoD), typically SYSTEM_SERVICE_EXCEPTION with STATUS_NO_MEMORY. This flaw allows a local unprivileged user to trigger a denial-of-service on affected Windows systems."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.9, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-14T02:09:26.792Z"}, "references": [{"tags": ["technical-description", "exploit"], "url": "https://github.com/emkaix/security-research/tree/main/CVE-2026-23762"}, {"tags": ["release-notes", "patch"], "url": "https://forum.vb-audio.com/viewtopic.php?p=7574#p7574"}, {"tags": ["release-notes", "patch"], "url": "https://forum.vb-audio.com/viewtopic.php?p=7527#p7527"}, {"tags": ["product"], "url": "https://vb-audio.com/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vb-audio-voicemeeter-and-matrix-drivers-dos-via-mmmaplockedpagesspecifycache"}], "source": {"discovery": "UNKNOWN"}, "title": "VB-Audio Voicemeeter & Matrix Drivers DoS via MmMapLockedPagesSpecifyCache", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T18:24:43.861785Z", "id": "CVE-2026-23762", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T18:24:52.849Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23762", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T18:24:43.861785Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T18:24:48.989Z"}}], "cna": {"title": "VB-Audio Voicemeeter & Matrix Drivers DoS via MmMapLockedPagesSpecifyCache", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Klaus Hahnenkamp"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VB-Audio Software", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "product": "Voicemeeter (Standard)", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.1.1.9"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "VB-Audio Software", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "product": "Voicemeeter Banana", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.1.1.9"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "VB-Audio Software", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "product": "Voicemeeter Potato", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.1.9"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "VB-Audio Software", "modules": ["vbmatrixvaio64*_win10.sys"], "product": "Matrix", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.2.2"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "VB-Audio Software", "modules": ["vbmatrixvaio64*_win10.sys"], "product": "Matrix Coconut", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.0.2.2"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/emkaix/security-research/tree/main/CVE-2026-23762", "tags": ["technical-description", "exploit"]}, {"url": "https://forum.vb-audio.com/viewtopic.php?p=7574#p7574", "tags": ["release-notes", "patch"]}, {"url": "https://forum.vb-audio.com/viewtopic.php?p=7527#p7527", "tags": ["release-notes", "patch"]}, {"url": "https://vb-audio.com/", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/vb-audio-voicemeeter-and-matrix-drivers-dos-via-mmmaplockedpagesspecifycache", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers map non-paged pool memory into user space via MmMapLockedPagesSpecifyCache using UserMode access without proper exception handling. If the mapping fails, such as when a process has exhausted available virtual address space, MmMapLockedPagesSpecifyCache raises an exception that is not caught, causing a kernel crash (BSoD), typically SYSTEM_SERVICE_EXCEPTION with STATUS_NO_MEMORY. This flaw allows a local unprivileged user to trigger a denial-of-service on affected Windows systems.", "supportingMedia": [{"type": "text/html", "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers map non-paged pool memory into user space via MmMapLockedPagesSpecifyCache using UserMode access without proper exception handling. If the mapping fails, such as when a process has exhausted available virtual address space, MmMapLockedPagesSpecifyCache raises an exception that is not caught, causing a kernel crash (BSoD), typically SYSTEM_SERVICE_EXCEPTION with STATUS_NO_MEMORY. This flaw allows a local unprivileged user to trigger a denial-of-service on affected Windows systems.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:twistedmatrix:twistedweb:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "1.0.2.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-14T02:09:26.792Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23762", "state": "PUBLISHED", "dateUpdated": "2026-05-14T02:09:26.792Z", "dateReserved": "2026-01-15T18:42:20.939Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-01-22T16:17:31.516Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter (Standard)", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "1.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter Banana", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "2.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter Potato", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "3.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbmatrixvaio64*_win10.sys"], "platforms": ["Windows"], "product": "Matrix", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "1.0.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbmatrixvaio64*_win10.sys"], "platforms": ["Windows"], "product": "Matrix Coconut", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "2.0.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers map non-paged pool memory into user space via MmMapLockedPagesSpecifyCache using UserMode access without proper exception handling. If the mapping fails, such as when a process has exhausted available virtual address space, MmMapLockedPagesSpecifyCache raises an exception that is not caught, causing a kernel crash (BSoD), typically SYSTEM_SERVICE_EXCEPTION with STATUS_NO_MEMORY. This flaw allows a local unprivileged user to trigger a denial-of-service on affected Windows systems."}, {"lang": "es", "value": "VB-Audio Voicemeeter, Voicemeeter Banana y Voicemeeter Potato (versiones que terminan en 1.1.1.9, 2.1.1.9 y 3.1.1.9 y anteriores, respectivamente), as\u00ed como VB-Audio Matrix y Matrix Coconut (versiones que terminan en 1.0.2.2 y 2.0.2.2 y anteriores, respectivamente), contienen una vulnerabilidad en sus controladores de audio virtuales (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys y vbaudio_vmvaio3*.sys). Los controladores mapean memoria del pool no paginado en el espacio de usuario a trav\u00e9s de MmMapLockedPagesSpecifyCache utilizando acceso en modo usuario sin un manejo adecuado de excepciones. Si el mapeo falla, como cuando un proceso ha agotado el espacio de direcciones virtual disponible, MmMapLockedPagesSpecifyCache genera una excepci\u00f3n que no es capturada, causando un fallo del kernel (BSoD), t\u00edpicamente SYSTEM_SERVICE_EXCEPTION con STATUS_NO_MEMORY. Esta falla permite a un usuario local sin privilegios activar una denegaci\u00f3n de servicio en sistemas Windows afectados."}], "id": "CVE-2026-23762", "lastModified": "2026-06-17T10:22:04.310", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23762", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T18:24:43.861785Z", "version": "2.0.3"}}]}, "published": "2026-01-22T17:16:37.480", "references": [{"source": "disclosure@vulncheck.com", "url": "https://forum.vb-audio.com/viewtopic.php?p=7527#p7527"}, {"source": "disclosure@vulncheck.com", "url": "https://forum.vb-audio.com/viewtopic.php?p=7574#p7574"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/emkaix/security-research/tree/main/CVE-2026-23762"}, {"source": "disclosure@vulncheck.com", "url": "https://vb-audio.com/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vb-audio-voicemeeter-and-matrix-drivers-dos-via-mmmaplockedpagesspecifycache"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T17:59:16.498746+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest releases of Voicemeeter Standard, Voicemeeter Banana, Voicemeeter Potato, Matrix, and Matrix Coconut, which remove the driver flaw.", "If an update is not yet available, uninstall or disable the affected virtual audio drivers so they cannot be loaded by user applications.", "Monitor Windows event logs for SYSTEM_SERVICE_EXCEPTION entries to detect accidental crashes and verify that no pending drivers remain installed."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "VB\u2011Audio Software markets several products that are impacted: Voicemeeter (Standard), Voicemeeter Banana, and Voicemeeter Potato, each of which has a vulnerable release ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 respectively, and older versions. The Matrix and Matrix Coconut audio drivers are also vulnerable in builds ending in 1.0.2.2 and 2.0.2.2, respectively.\n\n", "description_and_impact": "The vulnerability exists in the virtual audio drivers for VB\u2011Audio\u2019s Voicemeeter, Voicemeeter Banana, Voicemeeter Potato, Matrix, and Matrix Coconut. The drivers mistakenly expose non\u2011paged pool memory to user space through MmMapLockedPagesSpecifyCache with UserMode access, and they lack proper exception handling. When the mapping fails\u2014such as when a process has exhausted virtual address space\u2014an uncaught exception triggers a kernel crash, producing a blue\u2011screen loss of service. The flaw is limited to a local unprivileged user and results in a SYSTEM_SERVICE_EXCEPTION with STATUS_NO_MEMORY. The impact is a complete denial of service on the affected Windows system.\n\nThe flaw is not exploitable for privilege escalation or data exfiltration; it simply forces a reboot or crash, so confidentiality and integrity are not directly affected.\n\nThe affected code resides in the driver files vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys.\n\n", "risk_and_exploitability": "The CVSS score for this issue is 6.9, indicating moderate severity. The EPSS score is below 1\u202f%, meaning that at the time of analysis the estimated exploitation probability is very low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local user with an unprivileged account running a process that can intentionally or inadvertently consume all available virtual address space to cause the mapping to fail. Once triggered, the kernel crashes, leading to a system reboot.\n\nThe attack is straightforward: any user with the ability to run a custom process can exhaust address space and trigger the fault. No network interaction or elevated privileges are required. Because the flaw results only in a denial of service, the risk to confidentiality or integrity is negligible; the concern is operational availability.\n\n"}}}}, "created": "2026-01-23T16:32:16.727474+00:00", "updated": "2026-04-16T18:00:11.190582+00:00", "vendors": ["vb-audio_software", "vb-audio_software$PRODUCT$matrix", "vb-audio_software$PRODUCT$matrix_coconut", "vb-audio_software$PRODUCT$voicemeeter", "vb-audio_software$PRODUCT$voicemeeter_banana", "vb-audio_software$PRODUCT$voicemeeter_potato"]}