CVE-2026-23764

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23764", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-15T18:42:20.939Z", "datePublished": "2026-01-22T16:16:51.469Z", "dateUpdated": "2026-05-14T02:09:28.449Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter (Standard)", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "1.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter Banana", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "2.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter Potato", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "3.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbmatrixvaio64*_win10.sys"], "platforms": ["Windows"], "product": "Matrix", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "1.0.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbmatrixvaio64*_win10.sys"], "platforms": ["Windows"], "product": "Matrix Coconut", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "2.0.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:twistedmatrix:twistedweb:*:*:*:*:*:*:*:*", "versionEndIncluding": "1.0.2.2"}]}]}], "credits": [{"lang": "en", "type": "finder", "value": "Klaus Hahnenkamp"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers allocate non-paged pool and map it into user space, where a length value associated with the allocation is exposed and can be modified by an unprivileged local attacker. On subsequent IOCTL handling, the corrupted length is used directly as the IoAllocateMdl length argument without adequate integrity checks before building and mapping the MDL, which can cause a kernel crash (BSoD), typically PAGE_FAULT_IN_NONPAGED_AREA. This flaw allows a local user to trigger a denial-of-service on affected Windows systems."}], "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers allocate non-paged pool and map it into user space, where a length value associated with the allocation is exposed and can be modified by an unprivileged local attacker. On subsequent IOCTL handling, the corrupted length is used directly as the IoAllocateMdl length argument without adequate integrity checks before building and mapping the MDL, which can cause a kernel crash (BSoD), typically PAGE_FAULT_IN_NONPAGED_AREA. This flaw allows a local user to trigger a denial-of-service on affected Windows systems."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-823", "description": "CWE-823: Use of Out-of-range Pointer Offset", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-14T02:09:28.449Z"}, "references": [{"tags": ["technical-description", "exploit"], "url": "https://github.com/emkaix/security-research/tree/main/CVE-2026-23764"}, {"tags": ["release-notes", "patch"], "url": "https://forum.vb-audio.com/viewtopic.php?p=7574#p7574"}, {"tags": ["release-notes", "patch"], "url": "https://forum.vb-audio.com/viewtopic.php?p=7527#p7527"}, {"tags": ["product"], "url": "https://vb-audio.com/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vb-audio-voicemeeter-and-matrix-drivers-dos-via-corrupted-ioallocatemdl-length"}], "source": {"discovery": "UNKNOWN"}, "title": "VB-Audio Voicemeeter & Matrix Drivers DoS via Corrupted IoAllocateMdl Length", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T14:33:36.797145Z", "id": "CVE-2026-23764", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T14:33:42.334Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23764", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T14:33:36.797145Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T14:33:26.512Z"}}], "cna": {"title": "VB-Audio Voicemeeter & Matrix Drivers DoS via Corrupted IoAllocateMdl Length", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Klaus Hahnenkamp"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "VB-Audio Software", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "product": "Voicemeeter (Standard)", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.1.1.9"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "VB-Audio Software", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "product": "Voicemeeter Banana", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.1.1.9"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "VB-Audio Software", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "product": "Voicemeeter Potato", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.1.9"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "VB-Audio Software", "modules": ["vbmatrixvaio64*_win10.sys"], "product": "Matrix", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.2.2"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "VB-Audio Software", "modules": ["vbmatrixvaio64*_win10.sys"], "product": "Matrix Coconut", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.0.2.2"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/emkaix/security-research/tree/main/CVE-2026-23764", "tags": ["technical-description", "exploit"]}, {"url": "https://forum.vb-audio.com/viewtopic.php?p=7574#p7574", "tags": ["release-notes", "patch"]}, {"url": "https://forum.vb-audio.com/viewtopic.php?p=7527#p7527", "tags": ["release-notes", "patch"]}, {"url": "https://vb-audio.com/", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/vb-audio-voicemeeter-and-matrix-drivers-dos-via-corrupted-ioallocatemdl-length", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers allocate non-paged pool and map it into user space, where a length value associated with the allocation is exposed and can be modified by an unprivileged local attacker. On subsequent IOCTL handling, the corrupted length is used directly as the IoAllocateMdl length argument without adequate integrity checks before building and mapping the MDL, which can cause a kernel crash (BSoD), typically PAGE_FAULT_IN_NONPAGED_AREA. This flaw allows a local user to trigger a denial-of-service on affected Windows systems.", "supportingMedia": [{"type": "text/html", "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers allocate non-paged pool and map it into user space, where a length value associated with the allocation is exposed and can be modified by an unprivileged local attacker. On subsequent IOCTL handling, the corrupted length is used directly as the IoAllocateMdl length argument without adequate integrity checks before building and mapping the MDL, which can cause a kernel crash (BSoD), typically PAGE_FAULT_IN_NONPAGED_AREA. This flaw allows a local user to trigger a denial-of-service on affected Windows systems.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-823", "description": "CWE-823: Use of Out-of-range Pointer Offset"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:twistedmatrix:twistedweb:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "1.0.2.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-14T02:09:28.449Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23764", "state": "PUBLISHED", "dateUpdated": "2026-05-14T02:09:28.449Z", "dateReserved": "2026-01-15T18:42:20.939Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-01-22T16:16:51.469Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter (Standard)", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "1.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter Banana", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "2.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbvoicemeetervaio64*_win10.sys", "vbaudio_vmauxvaio*.sys", "vbaudio_vmvaio*.sys", "vbaudio_vmvaio3*.sys"], "platforms": ["Windows"], "product": "Voicemeeter Potato", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "3.1.1.9", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbmatrixvaio64*_win10.sys"], "platforms": ["Windows"], "product": "Matrix", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "1.0.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "modules": ["vbmatrixvaio64*_win10.sys"], "platforms": ["Windows"], "product": "Matrix Coconut", "vendor": "VB-Audio Software", "versions": [{"lessThanOrEqual": "2.0.2.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). The drivers allocate non-paged pool and map it into user space, where a length value associated with the allocation is exposed and can be modified by an unprivileged local attacker. On subsequent IOCTL handling, the corrupted length is used directly as the IoAllocateMdl length argument without adequate integrity checks before building and mapping the MDL, which can cause a kernel crash (BSoD), typically PAGE_FAULT_IN_NONPAGED_AREA. This flaw allows a local user to trigger a denial-of-service on affected Windows systems."}, {"lang": "es", "value": "VB-Audio Voicemeeter, Voicemeeter Banana y Voicemeeter Potato (versiones que terminan en 1.1.1.9, 2.1.1.9 y 3.1.1.9 y anteriores, respectivamente), as\u00ed como VB-Audio Matrix y Matrix Coconut (versiones que terminan en 1.0.2.2 y 2.0.2.2 y anteriores, respectivamente), contienen una vulnerabilidad en sus controladores de audio virtuales (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys y vbaudio_vmvaio3*.sys). Los controladores asignan un grupo no paginado y lo mapean en el espacio de usuario, donde un valor de longitud asociado con la asignaci\u00f3n est\u00e1 expuesto y puede ser modificado por un atacante local no privilegiado. En el manejo posterior de IOCTL, la longitud corrupta se utiliza directamente como el argumento de longitud de IoAllocateMdl sin comprobaciones de integridad adecuadas antes de construir y mapear el MDL, lo que puede causar un fallo del kernel (BSoD), t\u00edpicamente PAGE_FAULT_IN_NONPAGED_AREA. Esta falla permite a un usuario local activar una denegaci\u00f3n de servicio en sistemas Windows afectados."}], "id": "CVE-2026-23764", "lastModified": "2026-06-17T10:22:04.560", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23764", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T14:33:36.797145Z", "version": "2.0.3"}}]}, "published": "2026-01-22T17:16:37.757", "references": [{"source": "disclosure@vulncheck.com", "url": "https://forum.vb-audio.com/viewtopic.php?p=7527#p7527"}, {"source": "disclosure@vulncheck.com", "url": "https://forum.vb-audio.com/viewtopic.php?p=7574#p7574"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/emkaix/security-research/tree/main/CVE-2026-23764"}, {"source": "disclosure@vulncheck.com", "url": "https://vb-audio.com/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vb-audio-voicemeeter-and-matrix-drivers-dos-via-corrupted-ioallocatemdl-length"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-823"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:45:47.165288+00:00", "value": {"mitigation_remediation": ["Update all VB\u2011Audio Voicemeeter and Matrix drivers to the latest release from the vendor, ensuring the fixed driver binaries are installed on each affected machine.", "Verify that the driver files are located in the Windows system folder and possess the default read\u2011only attribute so that ordinary users cannot modify or replace them.", "Configure Device Guard or AppLocker to block unsigned or modified drivers from loading, limiting the window in which an unprivileged attacker could tamper with the driver\u2019s metadata."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects VB\u2011Audio Software\u2019s Voicemeeter Standard versions ending in 1.1.1.9 or earlier, Voicemeeter Banana versions ending in 2.1.1.9 or earlier, Voicemeeter Potato versions ending in 3.1.1.9 or earlier, Matrix versions ending in 1.0.2.2 or earlier, and Matrix Coconut versions ending in 2.0.2.2 or earlier. All products run on Microsoft Windows as audio drivers.", "description_and_impact": "VB\u2011Audio\u2019s virtual audio drivers expose a length value that can be altered by a non\u2011privileged local user. When the modified value is later used as the argument to IoAllocateMdl without proper validation, the kernel attempts to map the user\u2011controlled size as a non\u2011paged pool MDL. This results in a system crash, typically PAGE_FAULT_IN_NONPAGED_AREA, and denies availability for the affected Windows machine.", "risk_and_exploitability": "The CVSS base score of 6.8 indicates medium severity, and the EPSS score of less than 1% shows a very low likelihood of real\u2011world exploitation at the time of analysis. The flaw is not listed in the CISA KEV catalog. A local unprivileged user can trigger the crash by interacting with the vulnerable driver; no network or elevated privileges are required. Consequently, the risk is confined to local systems where the affected drivers are installed, but a single exploit causes an irreversible denial of service until the system is rebooted or patched."}}}}, "created": "2026-01-23T16:32:15.161436+00:00", "updated": "2026-04-18T04:00:08.395903+00:00", "vendors": ["vb-audio_software", "vb-audio_software$PRODUCT$matrix", "vb-audio_software$PRODUCT$matrix_coconut", "vb-audio_software$PRODUCT$voicemeeter", "vb-audio_software$PRODUCT$voicemeeter_banana", "vb-audio_software$PRODUCT$voicemeeter_potato"]}