Quick answers
- Is CVE-2026-40573 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40573 being exploited in the wild.
- How severe is CVE-2026-40573?
- High severity, with a CVSS score of 8.6, published 30 October 2026.
- Which products and versions are affected?
- Minecanton209 Novumos prior to 0.25-beta.1.
- Is there a fix for CVE-2026-40573?
- Yes: fixed in 0.25-beta.1. Until then: Disable the Nova interpreter and do not execute unverified .nv scripts. Manually review all Nova scripts before running them. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40573 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-40573?
- Check whether you run Minecanton209 Novumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.25-beta.1
Disable the Nova interpreter and do not execute unverified .nv scripts. Manually review all Nova scripts before running them.
Technical details
The Nova interpreter in NovumOS versions prior to 0.25-beta.1 executes in Ring 0 (kernel mode) with unrestricted access to kernel memory. The vulnerable component is the VM initialization in zig/nova/vm.zig; script execution is not isolated to a restricted Ring 3 privilege domain. A local attacker can load a malicious .nv script via the shell to achieve arbitrary code execution with kernel privileges without any security checks.
Affected products
- MinecAnton209 NovumOS prior to 0.25-beta.1
Timeline
- 2026-06-27: disclosed
- 2026-06-07: patched: Fix committed; patched version 0.25-beta.1 released
- 2026-10-30: advisory: NVD advisory published