NovumOS Nova interpreter: Privilege escalation to kernel mode (Ring 0)
Summary
The Nova script interpreter of the hobby operating system NovumOS runs in Ring 0 (kernel mode) with unrestricted access to kernel memory. A local user who runs a malicious .nv script through the shell can execute code with kernel privileges without any security checks. The CVSS base score is 8.6 (NVD/CNA); VulDB rates it 8.2.
Affected
- NovumOS versions before 0.25-beta.1 (GHSA-rq9v-wxp3-ffrr: <=0.23; CNA: < 0.25-beta.1)
- Affected component: Nova interpreter, VM initialization in zig/nova/vm.zig
Fixed in
- Fixed in NovumOS 0.25-beta.1
Workaround
- No vendor workaround published; the vendor advisory lists disabling the Nova interpreter and manually reviewing all Nova scripts before running them.
Exploitation
- No known exploitation in the wild.
- No public exploit confirmed; VulDB states no exploit is available. A vendor advisory PoC exists in the Nova language.
- Not listed in CISA KEV (not directly verified).
- EPSS: 0.13 % (percentile 3).
Our recommendation
- Check whether NovumOS is used in labs, education, test or embedded systems (asset inventory).
- Upgrade to NovumOS 0.25-beta.1 or later.
- Until upgraded, do not run untrusted .nv scripts and limit shell access to trusted users.
- Priority is low for typical SME environments; higher on shared or multi-user systems running NovumOS.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rq9v-wxp3-ffrr github.com
- Fix commit ca3e7a6 (NovumOS) github.com
- NovumOS tag v0.25-beta.1 github.com
- VulDB CVE-2026-40573 vuldb.com
- VulDB vulnerability 429406 vuldb.com
- OffSeq radar CVE-2026-40573 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:43.
Original description (NVD)
NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in `zig/nova/vm.zig` as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.