NovumOS CVE-2026-40317

Requires local code execution capability on a NovumOS system - the attacker must already run a Ring 3 user-mode process to invoke Syscall 12. CVSS vector PR:N indicates no authentication is required beyond the ability to execute user-mode code, meaning any process running in user space can trigger the vulnerability regardless of user account privileges. The system must be configured to support Ring 3 user-mode processes; workarounds specifically disable this to prevent exploitation. The vulnerability is NOT exploitable remotely (AV:L) - attackers need existing local access through another vector (application exploit, physical access, legitimate user account, or supply chain compromise of software running on NovumOS). Attack complexity is low (AC:L) with no special timing, race conditions, or complex setup required. UI:N confirms no user interaction beyond the attacker's own code execution. Exploitation is limited to x86-compatible hardware running NovumOS < 0.24 with user-mode processes enabled.

Real-world risk assessment reveals conflicting signals requiring careful interpretation. CVSS 9.3 (Critical) with AV:L/AC:L/PR:N reflects local attack vector with low complexity and no authentication barrier, paired with scope change (S:C) indicating privilege boundary escape from user to kernel mode. The PR:N (no privileges required) metric is technically accurate since any Ring 3 process can invoke syscalls, though this may mislead automated scanners - the attacker still needs local code execution to begin the attack chain. SSVC framework confirms POC availability and total technical impact (complete system compromise), but marks automatable:no due to the local-only nature. The contradiction emerges with EPSS: despite POC existence and critical CVSS, the 0.02% exploitation probability (5th percentile) suggests minimal real-world targeting. This discrepancy is explained by NovumOS being a niche custom operating system likely used in research, embedded systems, or specialized deployments rather than enterprise production environments. The vulnerability is severe for organizations actually running NovumOS - complete Ring 0 compromise is possible - but affects a limited user base. Defenders running this OS should treat as critical; organizations not using NovumOS can deprioritize. No CISA KEV listing confirms this is not being exploited in widespread attacks despite POC availability.

An attacker with local code execution on a NovumOS system (for example, through a compromised user application or physical access to a terminal) writes a small Ring 3 user-mode program that invokes Syscall 12 with a crafted entry point address targeting kernel memory space. The syscall accepts the malicious address without validation and transfers execution to attacker-controlled shellcode now running at Ring 0 privilege. With kernel-level access, the attacker disables security mechanisms, installs persistent rootkits, exfiltrates sensitive data from kernel memory, or manipulates hardware directly. SSVC confirms POC code exists, lowering the technical barrier for attackers already possessing local access.