Executive Summary

CVE-2026-23761 is a vulnerability in VB-Audio's virtual audio drivers used in Voicemeeter and Matrix products. The issue occurs because the drivers improperly initialize the FILE_OBJECT->FsContext field to a non-pointer magic value when a handle is opened with a special file attribute. If operations on this handle are forwarded down the audio driver stack instead of being handled by the VB-Audio driver, the invalid FsContext value is dereferenced, causing a kernel crash (Blue Screen of Death) with a SYSTEM_SERVICE_EXCEPTION and STATUS_ACCESS_VIOLATION error. This allows a local unprivileged user to trigger a denial-of-service on affected Windows systems. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a local unprivileged user to cause a denial-of-service (DoS) condition on affected Windows systems. Specifically, it can trigger a kernel crash resulting in a Blue Screen of Death (BSoD), which disrupts normal system operation and may require a reboot, potentially causing loss of unsaved data and system downtime. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if the affected VB-Audio virtual audio drivers (vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, vbaudio_vmvaio3*.sys) are present and in use on the system. Detection involves checking the installed versions of Voicemeeter and Matrix software to see if they are at or below the vulnerable versions (Voicemeeter ≤ 1.1.1.9, Voicemeeter Banana ≤ 2.1.1.9, Voicemeeter Potato ≤ 3.1.1.9, Matrix ≤ 1.0.2.2, Matrix Coconut ≤ 2.0.2.2). On Windows systems, commands such as 'driverquery' or 'Get-WmiObject Win32_SystemDriver' in PowerShell can list loaded drivers to check for these specific driver files. Additionally, monitoring for SYSTEM_SERVICE_EXCEPTION with STATUS_ACCESS_VIOLATION Blue Screen of Death (BSoD) errors in system logs may indicate exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the affected VB-Audio software (Voicemeeter, Voicemeeter Banana, Voicemeeter Potato, Matrix, and Matrix Coconut) to versions later than those listed as vulnerable. If updates are not available, restricting local unprivileged user access to the affected systems or disabling the vulnerable virtual audio drivers temporarily can reduce risk. Monitoring system stability and logs for signs of kernel crashes related to this vulnerability is also recommended. [1]

Useful 0 Not Useful 0