EUVD-2026-114458Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local shell access
-
DeliverySupply malicious .nv script
-
ExploitInterpreter runs script in Ring 0
-
ExecutionWrite arbitrary kernel memory
-
ImpactAchieve full kernel (Ring 0) control
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Unnecessary privilege execution
|
| Exploitation Conditions | Requires local shell access to a NovumOS instance running a version at or before 0.23 (prior to 0.25-beta.1), where the Nova interpreter executes in Ring 0 in the default configuration - no special feature toggle is needed, so any loadable .nv script runs with unrestricted kernel-memory access. The attacker must be able to load and execute a Nova script via the shell. Exploitation is limited by the need for local access (not remotely reachable) and by the small installed base; the GHSA workarounds are to disable the Nova interpreter / not run unverified .nv scripts and to manually review scripts, while the advisory states the complete fix is the architectural change in 0.25-beta.1 that runs Nova in Ring 3. |
| Impact | The signals point to a genuine but narrow-scope local privilege-escalation issue rather than a broadly exploitable emergency. The input CVSS vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 8.6) correctly captures a local, low-complexity flaw with a scope change and total compromise of confidentiality, integrity and availability - consistent with CWE-250 (execution with unnecessary privileges), since the Nova interpreter runs in Ring 0 by design. The vuln.today decision label is this_week, not act_now or emergency, which matches the overall picture: serious impact but requiring local access. No EPSS score is provided and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation. The GHSA advisory includes a short conceptual Nova PoC, but it is an illustrative snippet, not a verified weaponized exploit. One signal to verify: the input vector lists PR:N and UI:R, yet the mechanism is a local user running their own malicious .nv script, which argues for PR:L (local shell access needed) and UI:N (no third-party interaction) - treat the exact PR/UI metrics as unsettled. Overall this is a real priority for anyone actually running NovumOS, but its real-world risk is bounded by a rare deployment footprint and the local-access prerequisite. |
| Exploit ScenarioDerived | A local user with shell access on a NovumOS system prior to 0.25-beta.1 writes or obtains a malicious Nova (.nv) script and executes it from the shell. Because the Nova interpreter runs in Ring 0 with no bounds checking, the script directly reads and writes kernel memory, hijacking control flow to gain full kernel privileges. A conceptual PoC script is published in the GHSA advisory, but it is not verified working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Local privilege escalation in NovumOS allows an authenticated user with shell access to load a malicious .nv script that the Nova interpreter executes in Ring 0, giving unrestricted kernel-memory access and code execution at kernel privilege with scope change and high confidentiality, integrity and availability impact. The root cause is architectural rather than a memory-safety defect: Nova is not confined to a Ring 3 domain and no special feature toggle is required, so any loadable script runs with full kernel rights on versions at or before 0.23. A public PoC reference (a sample Nova script writing to kernel memory) is included in the GitHub advisory; it is not verified as working exploit code, there is no KEV listing, and exploitation is limited by the need for local access and the small installed base.
RemediationAI
Upgrade to NovumOS v0.25-beta.1, which is the vendor-released fix: it moves the Nova interpreter out of the kernel into a ring 3 user-mode VM (embedded nova.elf loaded through elf.zig load_and_run_nova, with console and file operations issued as int $0x80 syscalls), and the patch commit is https://github.com/MinecAnton209/NovumOS/commit/ca3e7a6b4bcdcac23413d39ecf863b94e6a3a207. If the upgrade cannot be applied immediately, the advisory's documented workarounds are to disable the Nova interpreter entirely and to avoid executing unverified .nv scripts, plus manually reviewing every Nova script before it is run; these are only partial mitigations because the interpreter still executes at ring 0 and any unreviewed script retains kernel-memory access, and the advisory states that the complete fix is the architectural change delivered in 0.25-beta.1. Limit shell access to trusted users in the interim, since the flaw requires a local user able to load a script through the shell.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
NovumOS is a 32-bit hobby operating system written in Zig and x86 assembly. Its Nova scripting language interpreter is compiled into and executed by the kernel, so the VM initialized in zig/nova/vm.zig (lines 67-73) runs at ring 0 with full access to kernel memory, and script execution is never isolated in a restricted ring 3 privilege domain. This maps to CWE-250 (Execution with Unnecessary Privileges): the interpreter does not need kernel rights, yet every script inherits them, so an ordinary user who can load a .nv file through the shell obtains kernel-level read/write primitives instead of being bounded by a syscall interface. The supplied advisory PoC illustrates the class by pointing a pointer at 0x100000 and writing attacker-controlled values into kernel structures. The upstream fix in commit ca3e7a6b reflects the architectural correction: an embedded nova.elf user-mode VM is loaded via elf.zig load_and_run_nova, and the new zig/nova_user command layer performs console, cursor, timing and other operations through int $0x80 syscall wrappers (eax number, ebx/ecx arguments) instead of direct kernel calls. The precise mechanism by which a script escalates to arbitrary control-flow hijack beyond the demonstrated kernel-memory write is not described in the available sources.
Know when Novumos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Local shell access needed (AV:L, PR:L), attacker runs their own script so UI:N; escaping the interpreter into Ring 0 is a scope change (S:C) with full C/I/A loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the Nova interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious .nv script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in zig/nova/vm.zig as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.
Technical POC Analysis
CWE-250: Execution with Unnecessary Privileges.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
NovumOS versions at or before 0.23 contain a high-severity architectural flaw (CVE-2026-40573) that allows any authenticated local user with shell access to execute scripts with full kernel privileges, potentially compromising the entire operating system. While no active exploitation has been observed and the installed base is small, the vulnerability enables complete system takeover by an insider or any user with legitimate access, which could lead to data breaches, operational disruption, and compliance violations. Leadership must prioritize remediation to protect sensitive data and maintain trust in the platform.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict shell access to trusted users, enforce least privilege, monitor for suspicious .nv script activity, implement application whitelisting to block unauthorized Nova scripts, and consider network segmentation or migration to alternative platforms for high-risk systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Syscall 12 (JumpToUser) in NovumOS versions prior to 0.24 executes arbitrary kernel code at Ring 0 privilege when invoke
Privilege escalation in NovumOS versions prior to 0.24 allows local unprivileged attackers to gain kernel-level executio
Exploit-DB