Live › vulnerability › CVE-2026-40573
NovumOS is a hobby 32-bit operating system written in Zig. Before version 0.25-beta.1, its Nova script interpreter runs in kernel mode, so a malicious .nv script loaded through the shell lets a local user run code with kernel privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Only systems running NovumOS before 0.25-beta.1 that let users load .nv scripts through the shell are exposed. Anyone not running NovumOS can skip this entry.
No product ranges from the sources yet.
0.25-beta.1.zig/nova/vm.zig in your source tree.0.25-beta.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the Nova interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious .nv script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in zig/nova/vm.zig as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-40573")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.