CVE-2026-23763

What it is

VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a local privilege escalation vulnerability in the VBMatrix VAIO virtual audio driver (vbmatrixvaio64*_win10.sys). The driver allocates a 128-byte non-paged pool buffer and, upon receiving IOCTL 0x222060, maps it into user space using an MDL and MmMapLockedPagesSpecifyCache. Because the allocation size is not page-aligned, the mapping exposes the entire 0x1000-byte kernel page containing the buffer plus adjacent non-paged pool allocations with read/write permissions. An unprivileged local attacker can open a device handle (using the required 0x800 attribute flag), invoke the IOCTL to obtain the mapping, and then read or modify live kernel objects and pointers present on that page. This enables bypass of KASLR, arbitrary kernel memory read/write within the exposed page, corruption of kernel objects, and escalation to SYSTEM.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-01-15 18:42 UTC ReservedThe CVE id was reserved by its CNA
2. 2026-01-22 17:16 UTC PublishedDisclosed publicly on CVE.org and NVD
3. 2026-06-17 10:22 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 0.2% in the next 30 days (EPSS).
• Severity: 8.5 HIGH (CVSS).
• Fix: none linked yet, which raises it.

Details

Published

2026-01-22 17:16 UTC

Last modified

2026-06-17 10:22 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-668 · Resource exposure

Record status

Deferred

Attack profile CVSS 4.0 · 8.5

Attack vector

Local

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2026-23763.md and follow it. Check whether this project is affected by CVE-2026-23763. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge