CVE-2026-40573

The record

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in `zig/nova/vm.zig` as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.

Affected packages

Related vulnerabilities

• CVE-2025-30046 In the CGM CLININET application server, multiple processes responsible for HL7… CWE-250
• CVE-2026-91335 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-250
• CVE-2026-104795 The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that… CWE-250
• CVE-2026-87709 Improper access control in Windows Host Guardian Service allows an authorized attacker to… CWE-250
• CVE-2026-107176 A flaw was found in the cluster-samples-operator. CWE-250
• CVE-2026-92574 A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a… CWE-250
• CVE-2026-79942 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-250
• CVE-2026-87506 Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-250