Read the docs
TI-2026-83386 Aliases CVE-2026-40573

Nova interpreter runs with kernel privileges in NovumOS

Priority HIGH 72CWE-250Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-250.

Summary

NovumOS, a custom 32-bit operating system written in Zig and x86 Assembly, is affected before 0.25-beta.1. The Nova interpreter runs in Ring 0 with unrestricted kernel memory access instead of an isolated Ring 3 domain, which is the execution-with-unnecessary-privileges weakness (CWE-250). A local user who loads a malicious .nv script through the shell can execute code with kernel privileges without security checks.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. Prior to version 0.25-beta.1, the `Nova` interpreter runs in Ring 0 with unrestricted kernel-memory access. Loading a malicious `.nv` script through the shell permits a local user to execute code with kernel privileges without security checks. The advisory identifies VM initialization in `zig/nova/vm.zig` as the affected component; script execution is not isolated in a restricted Ring 3 privilege domain. This issue is fixed in version 0.25-beta.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00129 2nd percentileScored 2026-11-07
Fix Fixed NovumOS (MinecAnton209): 0.25-beta.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MinecAnton209NovumOSbefore 0.25-beta.10.25-beta.1Patch availableCNA
  • NovumOS VendorMinecAnton209 Affected before 0.25-beta.1 Fixed in 0.25-beta.1 Patch available CNA

Remediation

Update NovumOS to version 0.25-beta.1, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA NovumOS (MinecAnton209) Fixed in 0.25-beta.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-40573
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: LOW → HIGH

References

Other 3

  • TI-2026-29094 NovumOS has Privilege Escalation in the Syscall Interface CVSS 3.1CRITICAL 9.4
  • TI-2026-29313 NovumOS has Arbitrary Memory Mapping via Syscall 15 (MemoryMapRange) CVSS 3.1CRITICAL 9.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences