CVE-2026-40573— NovumOS: Nova Interpreter Privilege Escalation
Quick assessment
Affected
MinecAnton209 NovumOS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NovumOS 是一款使用 Zig 语言和 x86 汇编编写的定制 32 位操作系统。在 0.25-beta.1 版本之前，其 解释器运行于特权级 0（Ring 0），并拥有无限制的 kernel 内存访问权限。通过 Shell 加载恶意的 脚本，可使本地用户在未经任何安全检查的情况下，以内核权限执行任意代码。该安全公告指出，受影响组件为 中的虚拟机初始化逻辑；脚本执行并未被隔离在受限的特权级 3（Ring 3）域中。此问题已在 0.25-beta.1 版本中修复。
Possible ATT&CK Techniques 2 AI
T1055.004 · Asynchronous Procedure Call T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MinecAnton209 | NovumOS | < 0.25-beta.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40573
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NovumOS: Nova Interpreter Privilege Escalation
Source: CVE Program / CVE List V5
Vulnerability Description
NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in `zig/nova/vm.zig` as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
带着不必要的权限执行
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MinecAnton209 | NovumOS | < 0.25-beta.1 | - |
|
II. Public POCs for CVE-2026-40573
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40573
请登录查看更多情报信息。