CVE-2026-23763
Unknown Unknown - Not Provided
Local Privilege Escalation in VB-Audio VBMatrix Virtual Audio Driver

Publication date: 2026-01-22

Last updated on: 2026-01-22

Assigner: VulnCheck

Description
VB-Audio Matrix and Matrix Coconut (versions ending in 1.0.2.2 and 2.0.2.2 and earlier, respectively), contain a local privilege escalation vulnerability in the VBMatrix VAIO virtual audio driver (vbmatrixvaio64*_win10.sys). The driver allocates a 128-byte non-paged pool buffer and, upon receiving IOCTL 0x222060, maps it into user space using an MDL and MmMapLockedPagesSpecifyCache. Because the allocation size is not page-aligned, the mapping exposes the entire 0x1000-byte kernel page containing the buffer plus adjacent non-paged pool allocations with read/write permissions. An unprivileged local attacker can open a device handle (using the required 0x800 attribute flag), invoke the IOCTL to obtain the mapping, and then read or modify live kernel objects and pointers present on that page. This enables bypass of KASLR, arbitrary kernel memory read/write within the exposed page, corruption of kernel objects, and escalation to SYSTEM.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-22
Last Modified
2026-01-22
Generated
2026-05-07
AI Q&A
2026-01-22
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
vb-audio matrix to 1.0.2.2 (inc)
vb-audio matrix_coconut to 2.0.2.2 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

CVE-2026-23763 is a local privilege escalation vulnerability in the VBMatrix VAIO virtual audio driver used by VB-Audio Matrix and Matrix Coconut software. The driver allocates a 128-byte buffer in kernel memory but maps an entire 0x1000-byte kernel page containing this buffer into user space due to improper alignment. This mapping exposes adjacent kernel memory with read/write permissions. An unprivileged local attacker can exploit this by opening a device handle and invoking a specific IOCTL command to access and modify kernel memory, bypassing security protections like KASLR and escalating their privileges to SYSTEM level. [2]


How can this vulnerability impact me? :

This vulnerability allows an unprivileged local attacker to read and write arbitrary kernel memory within the exposed page, corrupt kernel objects, bypass Kernel Address Space Layout Randomization (KASLR), and escalate their privileges to SYSTEM. This means an attacker could gain full control over the affected system, potentially leading to unauthorized access, data theft, system manipulation, or disruption of services. [2]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart