CVE-2026-40572

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40572", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-14T13:24:29.474Z", "datePublished": "2026-04-18T00:16:02.590Z", "dateUpdated": "2026-04-20T14:55:57.521Z"}, "containers": {"cna": {"title": "NovumOS has Arbitrary Memory Mapping via Syscall 15 (MemoryMapRange)", "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "lang": "en", "description": "CWE-269: Improper Privilege Management", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rg7m-6vh7-f4v2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rg7m-6vh7-f4v2"}, {"name": "https://github.com/MinecAnton209/NovumOS/releases/tag/v0.24", "tags": ["x_refsource_MISC"], "url": "https://github.com/MinecAnton209/NovumOS/releases/tag/v0.24"}], "affected": [{"vendor": "MinecAnton209", "product": "NovumOS", "versions": [{"version": "< 0.24", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T00:16:02.590Z"}, "descriptions": [{"lang": "en", "value": "NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode processes to map arbitrary virtual address ranges into their address space without validating against forbidden regions, including critical kernel structures such as the IDT, GDT, TSS, and page tables. A local attacker can exploit this to modify kernel interrupt handlers, resulting in privilege escalation from user mode to kernel context. This issue has been fixed in version 0.24."}], "source": {"advisory": "GHSA-rg7m-6vh7-f4v2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T14:45:37.202840Z", "id": "CVE-2026-40572", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:55:57.521Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40572", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-20T14:45:37.202840Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:45:38.965Z"}}], "cna": {"title": "NovumOS has Arbitrary Memory Mapping via Syscall 15 (MemoryMapRange)", "source": {"advisory": "GHSA-rg7m-6vh7-f4v2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "MinecAnton209", "product": "NovumOS", "versions": [{"status": "affected", "version": "< 0.24"}]}], "references": [{"url": "https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rg7m-6vh7-f4v2", "name": "https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rg7m-6vh7-f4v2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/MinecAnton209/NovumOS/releases/tag/v0.24", "name": "https://github.com/MinecAnton209/NovumOS/releases/tag/v0.24", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode processes to map arbitrary virtual address ranges into their address space without validating against forbidden regions, including critical kernel structures such as the IDT, GDT, TSS, and page tables. A local attacker can exploit this to modify kernel interrupt handlers, resulting in privilege escalation from user mode to kernel context. This issue has been fixed in version 0.24."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269: Improper Privilege Management"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-18T00:16:02.590Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40572", "state": "PUBLISHED", "dateUpdated": "2026-04-20T14:55:57.521Z", "dateReserved": "2026-04-14T13:24:29.474Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-18T00:16:02.590Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "NovumOS", "vendor": "MinecAnton209", "versions": [{"status": "affected", "version": "< 0.24"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:minecanton209:novumos:*:*:*:*:*:*:*:*", "matchCriteriaId": "A40C9D50-FA65-41F9-859B-D8C31D3E55AC", "versionEndExcluding": "0.24", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode processes to map arbitrary virtual address ranges into their address space without validating against forbidden regions, including critical kernel structures such as the IDT, GDT, TSS, and page tables. A local attacker can exploit this to modify kernel interrupt handlers, resulting in privilege escalation from user mode to kernel context. This issue has been fixed in version 0.24."}, {"lang": "es", "value": "NovumOS es un sistema operativo personalizado de 32 bits escrito en Zig y ensamblador x86. En versiones anteriores a la 0.24, la llamada al sistema 15 (MemoryMapRange) permite a los procesos en modo usuario de Anillo 3 mapear rangos de direcciones virtuales arbitrarios en su espacio de direcciones sin validar contra regiones prohibidas, incluyendo estructuras cr\u00edticas del kernel como la IDT, GDT, TSS y las tablas de p\u00e1ginas. Un atacante local puede explotar esto para modificar los manejadores de interrupci\u00f3n del kernel, lo que resulta en una escalada de privilegios de modo usuario a contexto de kernel. Este problema ha sido solucionado en la versi\u00f3n 0.24."}], "id": "CVE-2026-40572", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40572", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T14:45:37.202840Z", "version": "2.0.3"}}]}, "published": "2026-04-18T01:16:19.663", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/MinecAnton209/NovumOS/releases/tag/v0.24"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rg7m-6vh7-f4v2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.24)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "NovumOS", "source": "cna", "vendor": "MinecAnton209"}, "product": "novumos", "vendor": "minecanton209"}], "analysis": {"en": {"generated_at": "2026-04-18T08:42:32.184222+00:00", "value": {"mitigation_remediation": ["Upgrade NovumOS to version 0.24 or later, which removes the unchecked address mapping in Syscall 15.", "If an upgrade cannot be performed immediately, limit unprivileged processes from accessing syscall 15 by adjusting kernel policy or disabling the call via configuration settings.", "Continuously monitor system logs for signs of privilege escalation attempts or unexpected modifications to kernel data structures and enforce strict audit policies for kernel interactions."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected system is NovumOS, produced by MinecAnton209. All releases prior to 0.24 are vulnerable; the patch that fixes the issue was introduced in version 0.24.", "description_and_impact": "The vulnerability lies in Syscall 15 (MemoryMapRange), which permits a Ring 3 user-mode process to map any virtual address range without checking against protected kernel regions. This flaw means an attacker can map critical structures such as the IDT, GDT, TSS, or page tables, and then overwrite kernel interrupt handlers. The result is that the attacker can hijack kernel control flow and gain elevated privileges, effectively bypassing isolation between user and kernel space.", "risk_and_exploitability": "The CVSS score of 9 indicates a high severity of impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The exploit requires local execution and relies on the ability to invoke syscall 15 from a user-level process. Because the attacker can manipulate kernel interrupt handlers, a successful attack leads to complete privilege escalation, allowing unrestricted control over the system."}}}}, "created": "2026-04-18T08:45:41.384885+00:00", "updated": "2026-04-20T14:58:58.949077+00:00", "vendors": ["minecanton209", "minecanton209$PRODUCT$novumos"]}