CVE-2026-23762 Overview
CVE-2026-23762 is a denial-of-service vulnerability affecting VB-Audio's virtual audio driver products, including Voicemeeter, Voicemeeter Banana, Voicemeeter Potato, VB-Audio Matrix, and Matrix Coconut. The vulnerability exists in the virtual audio drivers which improperly handle exceptions when mapping non-paged pool memory into user space. When the memory mapping operation fails—such as when a process has exhausted available virtual address space—the unhandled exception causes a kernel crash resulting in a Blue Screen of Death (BSoD).
Critical Impact
A local unprivileged user can trigger a system-wide denial-of-service by causing a kernel crash (BSoD) with SYSTEM_SERVICE_EXCEPTION and STATUS_NO_MEMORY, affecting Windows system availability.
Affected Products
- VB-Audio Voicemeeter versions ending in 1.1.1.9 and earlier
- VB-Audio Voicemeeter Banana versions ending in 2.1.1.9 and earlier
- VB-Audio Voicemeeter Potato versions ending in 3.1.1.9 and earlier
- VB-Audio Matrix versions ending in 1.0.2.2 and earlier
- VB-Audio Matrix Coconut versions ending in 2.0.2.2 and earlier
- Affected drivers: vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, vbaudio_vmvaio3*.sys
Discovery Timeline
- 2026-01-22 - CVE-2026-23762 published to NVD
- 2026-01-22 - Last updated in NVD database
Technical Details for CVE-2026-23762
Vulnerability Analysis
This vulnerability is classified under CWE-755 (Improper Handling of Exceptional Conditions). The flaw resides in VB-Audio's virtual audio drivers, which utilize the Windows kernel function MmMapLockedPagesSpecifyCache to map non-paged pool memory into user space with UserMode access. The core issue is the absence of proper exception handling around this memory mapping operation.
When a process has exhausted its available virtual address space or other resource constraints prevent successful memory mapping, MmMapLockedPagesSpecifyCache raises an exception rather than returning an error code. Without a structured exception handler (SEH) to catch this exception, the kernel-mode driver allows the exception to propagate, resulting in a system crash. The BSoD typically manifests with the stop code SYSTEM_SERVICE_EXCEPTION accompanied by STATUS_NO_MEMORY.
Root Cause
The root cause is improper exception handling in the kernel-mode audio drivers. The drivers call MmMapLockedPagesSpecifyCache without wrapping the call in a try/except block. According to Microsoft documentation, this function can raise exceptions when it cannot map the specified pages. The vulnerable drivers assume the mapping will always succeed, violating defensive programming principles for kernel-mode code where unhandled exceptions are fatal to the entire system.
Attack Vector
The attack vector is local, requiring an attacker to have local access to a Windows system with the vulnerable VB-Audio drivers installed. An unprivileged local user can exploit this vulnerability by deliberately exhausting the virtual address space of a process that interacts with the audio driver, or by creating conditions that cause the memory mapping to fail. When the mapping fails and raises an exception, the kernel crashes immediately, resulting in a denial-of-service condition that persists until the system is manually rebooted.
The attack does not require elevated privileges, making it accessible to any user account on the affected system. Detailed technical analysis and research findings are available in the GitHub CVE-2026-23762 Research repository.
Detection Methods for CVE-2026-23762
Indicators of Compromise
- Windows Event Log entries showing SYSTEM_SERVICE_EXCEPTION with STATUS_NO_MEMORY stop codes
- Unexpected system reboots or BSoD events on systems with VB-Audio products installed
- Memory dump files (MEMORY.DMP) referencing VB-Audio driver files in the stack trace
- Crash dump analysis pointing to vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, or related driver files
Detection Strategies
- Monitor Windows Event Logs for bugcheck events (Event ID 1001 in System log) associated with VB-Audio driver modules
- Implement endpoint detection rules to identify processes exhausting virtual address space before interacting with audio drivers
- Use crash dump analysis tools to correlate system crashes with vulnerable driver file signatures
- Deploy SentinelOne agents to detect anomalous process behavior patterns indicative of DoS exploitation attempts
Monitoring Recommendations
- Configure centralized logging to aggregate Windows crash events across endpoints with VB-Audio software
- Establish baseline metrics for system stability and alert on anomalous BSoD frequency
- Monitor for repeated system crashes on specific endpoints, which may indicate active exploitation
- Implement driver inventory tracking to identify systems running vulnerable VB-Audio driver versions
How to Mitigate CVE-2026-23762
Immediate Actions Required
- Identify all systems in your environment with VB-Audio Voicemeeter, Matrix, or related products installed
- Assess criticality and determine if the software is essential for business operations
- Consider temporarily removing or disabling the vulnerable drivers on high-value systems until patches are available
- Monitor VB-Audio official channels for security updates and apply patches as soon as they are released
Patch Information
As of the publication date, users should check the VB-Audio Official Website for updated driver versions that address this vulnerability. Community discussion regarding this issue can be found on the VB-Audio Forum Discussion. Additional advisory information is available from VulnCheck Advisory for VB-Audio.
Workarounds
- Restrict local access to systems running vulnerable VB-Audio drivers to trusted users only
- Consider using alternative audio routing software on critical systems until patches are available
- Implement application control policies to limit which processes can interact with the audio subsystem
- Enable Windows Error Reporting and automatic memory dump collection to facilitate incident analysis
# Query for installed VB-Audio drivers on Windows systems
driverquery /v | findstr /i "vbvoicemeeter vbmatrix vbaudio"
# Check driver file versions in System32\drivers
dir %SystemRoot%\System32\drivers\vb*.sys
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
