# CVE-2026-40572: NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15…

Source: https://junglewise.ai/threats/cve-2026-40572-novumos-is-a-custom-32-bit-operating-system-written-in-zig-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-18  
License: CC BY 4.0 with a link back

CVE-2026-40572 · Severity: critical · CVSS 9 · Published 2026-04-18

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (MemoryMapRange) allows Ring 3 user-mode processes to map arbitrary virtual address ranges into their address space without validating against forbidden regions, including critical kernel structures such as the IDT, GDT, TSS, and page tables. A local attacker can exploit this to modify kernel interrupt handlers, resulting in privilege escalation from user mode to kernel context. This issue has been fixed in version 0.24.

Technologies: [Minecanton209 Novumos](https://junglewise.ai/threats/technologies/novumos). Vendors: [Minecanton209](https://junglewise.ai/threats/vendors/minecanton209).

## Quick answers

**Is CVE-2026-40572 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40572 being exploited in the wild.

**How severe is CVE-2026-40572?** Critical severity, with a CVSS score of 9, published 18 April 2026.

**Which products and versions are affected?** Minecanton209 Novumos. The advisory does not name versions.

**Is there a fix for CVE-2026-40572?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-40572?** Check whether you run Minecanton209 Novumos. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Minecanton209 Novumos

## Related threats

- [NovumOS Nova interpreter privilege escalation](https://junglewise.ai/threats/cve-2026-40573-novumos-is-a-custom-32-bit-operating-system-written-in-zig-and)
- [NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12…](https://junglewise.ai/threats/cve-2026-40317-novumos-is-a-custom-32-bit-operating-system-written-in-zig-and)