CVE-2026-23764 – This vulnerability allows unprivileged local at... (How to Fix)

Q: What is the severity of CVE-2026-23764?

CVE-2026-23764 has a CVSS score of N/A (Unknown). This vulnerability allows unprivileged local attackers to trigger a kernel crash (Blue Screen of Death) on Windows systems running vulnerable VB-Audio virtual audio drivers. The flaw involves corrupting a length value in user space that is later used without validation during IOCTL handling, leading to denial-of-service. Affected users include anyone running Voicemeeter, Voicemeeter Banana, Voicemeeter Potato, VB-Audio Matrix, or Matrix Coconut software.

📋 TL;DR

This vulnerability allows unprivileged local attackers to trigger a kernel crash (Blue Screen of Death) on Windows systems running vulnerable VB-Audio virtual audio drivers. The flaw involves corrupting a length value in user space that is later used without validation during IOCTL handling, leading to denial-of-service. Affected users include anyone running Voicemeeter, Voicemeeter Banana, Voicemeeter Potato, VB-Audio Matrix, or Matrix Coconut software.

💻 Affected Systems

Products:

VB-Audio Voicemeeter
Voicemeeter Banana
Voicemeeter Potato
VB-Audio Matrix
Matrix Coconut

Versions: Voicemeeter: versions ending in 1.1.1.9 and earlier; Voicemeeter Banana: versions ending in 2.1.1.9 and earlier; Voicemeeter Potato: versions ending in 3.1.1.9 and earlier; VB-Audio Matrix: versions ending in 1.0.2.2 and earlier; Matrix Coconut: versions ending in 2.0.2.2 and earlier

Operating Systems: Windows

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability resides in virtual audio drivers: vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system crash (BSOD) requiring reboot, potentially causing data loss or service disruption on affected Windows machines.

🟠

Likely Case

Local denial-of-service attack where any user can crash the system, disrupting audio functionality and requiring reboot.

🟢

If Mitigated

Limited to local users only; remote attackers cannot exploit this without first gaining local access.

🌐 Internet-Facing: LOW - This is a local-only vulnerability requiring local user access to exploit.

🏢 Internal Only: HIGH - Any local user (including low-privileged accounts) can trigger system crashes on vulnerable machines.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit code is publicly available on GitHub, making weaponization straightforward for attackers with local access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check vendor forums for latest updates; patches were discussed in forum posts but specific version numbers not provided in CVE details

Vendor Advisory: https://forum.vb-audio.com/viewtopic.php?p=7527#p7527

Restart Required: Yes

Instructions:

1. Visit VB-Audio website or forums. 2. Download latest versions of affected software. 3. Install updates. 4. Reboot system to load updated drivers.

🔧 Temporary Workarounds

Driver Removal

windows

Uninstall or disable vulnerable VB-Audio virtual audio drivers

sc stop [driver_service_name]
sc delete [driver_service_name]
Remove via Programs and Features

Access Restriction

windows

Restrict local user access to systems running vulnerable software

🧯 If You Can't Patch

Restrict local user access to only trusted accounts on affected systems
Monitor for BSOD events and investigate crashes on systems running VB-Audio software

🔍 How to Verify

Check if Vulnerable:

Check installed VB-Audio software versions against affected version ranges; examine driver files in System32\drivers for vulnerable driver names

Check Version:

Check program versions in Control Panel > Programs and Features or via software about dialogs

Verify Fix Applied:

Verify updated software versions are installed and check that driver files have been updated

📡 Detection & Monitoring

Log Indicators:

Windows Event Logs showing PAGE_FAULT_IN_NONPAGED_AREA crashes
System reboots without clear cause
Driver-related crash dumps

Network Indicators:

None - this is a local-only vulnerability

SIEM Query:

EventID=41 OR EventID=1001 AND Source="Microsoft-Windows-Kernel-Power" AND Description contains "PAGE_FAULT_IN_NONPAGED_AREA"

📊 Metadata

CVE ID: CVE-2026-23764

CVSS v3 Score: N/A (Unknown)

CWE: CWE-823

EPSS Score: 0.02% exploit probability (2.9th percentile)

Published: January 22, 2026

Last Updated: January 26, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-23764, you might also want to check these: