# CVE-2026-40573: NovumOS Nova interpreter privilege escalation

Source: https://junglewise.ai/threats/cve-2026-40573-novumos-is-a-custom-32-bit-operating-system-written-in-zig-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-40573 · Severity: high · CVSS 8.6 · Published 2026-10-30

NovumOS is a custom 32-bit operating system that runs a Nova programming language interpreter with full kernel privileges. An attacker can load a malicious Nova script through the shell to execute arbitrary code with kernel-level access and modify system memory, bypassing all security protections and gaining complete control of the system.

Technologies: [Minecanton209 Novumos](https://junglewise.ai/threats/technologies/novumos). Vendors: [Minecanton209](https://junglewise.ai/threats/vendors/minecanton209).

## Quick answers

**Is CVE-2026-40573 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40573 being exploited in the wild.

**How severe is CVE-2026-40573?** High severity, with a CVSS score of 8.6, published 30 October 2026.

**Which products and versions are affected?** Minecanton209 Novumos prior to 0.25-beta.1.

**Is there a fix for CVE-2026-40573?** Yes: fixed in 0.25-beta.1. Until then: Disable the Nova interpreter and do not execute unverified .nv scripts. Manually review all Nova scripts before running them. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40573 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-40573?** Check whether you run Minecanton209 Novumos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.25-beta.1

Disable the Nova interpreter and do not execute unverified .nv scripts. Manually review all Nova scripts before running them.

## Technical details

The Nova interpreter in NovumOS versions prior to 0.25-beta.1 executes in Ring 0 (kernel mode) with unrestricted access to kernel memory. The vulnerable component is the VM initialization in zig/nova/vm.zig; script execution is not isolated to a restricted Ring 3 privilege domain. A local attacker can load a malicious .nv script via the shell to achieve arbitrary code execution with kernel privileges without any security checks.

## Affected products

- MinecAnton209 NovumOS prior to 0.25-beta.1

## Timeline

- 2026-06-27: disclosed
- 2026-06-07: patched: Fix committed; patched version 0.25-beta.1 released
- 2026-10-30: advisory: NVD advisory published

## References

- [https://github.com/MinecAnton209/NovumOS/commit/ca3e7a6b4bcdcac23413d39ecf863b94e6a3a207](https://github.com/MinecAnton209/NovumOS/commit/ca3e7a6b4bcdcac23413d39ecf863b94e6a3a207)
- [https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rq9v-wxp3-ffrr](https://github.com/MinecAnton209/NovumOS/security/advisories/GHSA-rq9v-wxp3-ffrr)

## Related threats

- [NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15…](https://junglewise.ai/threats/cve-2026-40572-novumos-is-a-custom-32-bit-operating-system-written-in-zig-and)
- [NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12…](https://junglewise.ai/threats/cve-2026-40317-novumos-is-a-custom-32-bit-operating-system-written-in-zig-and)