{"id":"CVE-2026-40573","aliases":[],"cve":{"records":[{"id":"CVE-2026-40573","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-04-14T13:24:29.474Z","published":"2026-10-30T20:31:13.209Z","modified":"2026-11-05T02:46:22.700Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T20:31:13.209Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-05T02:46:22.700Z"}],"references":[{"url":"https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rq9v-wxp3-ffrr","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/MinecAnton209/NovumOS/commit/ca3e7a6b4bcdcac23413d39ecf863b94e6a3a207","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/MinecAnton209/NovumOS/tree/v0.25-beta.1","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rq9v-wxp3-ffrr","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-250","description":"CWE-250: Execution with Unnecessary Privileges","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-05T02:45:57.465546Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"NovumOS: Nova Interpreter Privilege Escalation","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in `zig/nova/vm.zig` as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.","score":8.6,"severity":"high","published":"2026-10-30T20:31:13.209Z","modified":"2026-11-05T02:46:22.700Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"MinecAnton209","name":"NovumOS","platforms":[],"versions":[{"version":"< 0.25-beta.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-40573"}],"remediation":[],"references":["https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rq9v-wxp3-ffrr","https://github.com/MinecAnton209/NovumOS/commit/ca3e7a6b4bcdcac23413d39ecf863b94e6a3a207","https://github.com/MinecAnton209/NovumOS/tree/v0.25-beta.1"],"sources":[{"name":"CVE","id":"CVE-2026-40573","modified":"2026-11-05T02:46:22.700Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-40573"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":8.6}],"sourceAffected":[],"observedAt":"2026-11-05T03:15:07.633Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:00:32.242Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T21:30:39.527Z","attemptedAt":"2026-10-30T21:30:39.527Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T21:30:39.633Z","attemptedAt":"2026-10-30T21:30:39.633Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T21:30:36.057Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T21:30:37.755Z","attemptedAt":"2026-10-30T21:30:37.755Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-40573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40573","modified":"2026-10-30T21:16:53.670","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","checkedAt":"2026-10-30T21:30:39.527Z"}],"aiSummary":{"text":"NovumOS versions prior to 0.25-beta.1 have a privilege escalation weakness, allowing local users to execute code with kernel privileges via a malicious `.nv` script. The `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Local access is required to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:01:09.227Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-40573"}]}}