CVE-2026-23761

The record

VB-Audio Voicemeeter, Voicemeeter Banana, and Voicemeeter Potato (versions ending in 1.1.1.9, 2.1.1.9, and 3.1.1.9 and earlier, respectively), as well as VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a vulnerability in their virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys). When a handle is opened with a special file attribute value, the drivers improperly initialize FILE_OBJECT->FsContext to a non-pointer magic value. If subsequent operations are not handled by the VB-Audio driver and are forwarded down the audio driver stack (e.g., via PortCls to ks.sys), the invalid FsContext value can be dereferenced, causing a kernel crash (BSoD), typically SYSTEM_SERVICE_EXCEPTION with STATUS_ACCESS_VIOLATION. This flaw allows a local unprivileged user to trigger a denial-of-service on affected Windows systems.

Affected packages

Related vulnerabilities

• CVE-2026-115327 libyang through 6.4.13 contains an uninitialized pointer free vulnerability in… CWE-824
• CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-824
• CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-824
• CVE-2026-88054 Tesseract is an open source OCR engine. CWE-824
• CVE-2026-54920 OpenEXR is the reference implementation and specification for the EXR image format… CWE-824
• CVE-2026-16409 Invalid pointer in the Security: PSM component. CWE-824
• CVE-2026-16353 Invalid pointer in the DOM: Bindings (WebIDL) component. CWE-824
• CVE-2026-47908 Dreamweaver Desktop versions 21.7 and earlier are affected by an Access of Uninitialized… CWE-824