CVE-2026-23763: VB-Audio Matrix Privilege Escalation Flaw

CVE-2026-23763 Overview

CVE-2026-23763 is a local privilege escalation vulnerability affecting VB-Audio Matrix and Matrix Coconut audio software. The vulnerability resides in the VBMatrix VAIO virtual audio driver (vbmatrixvaio64*_win10.sys), which improperly exposes kernel memory to user space. When the driver allocates a 128-byte non-paged pool buffer and maps it via an MDL (Memory Descriptor List) using MmMapLockedPagesSpecifyCache, it inadvertently exposes an entire 0x1000-byte kernel page containing adjacent non-paged pool allocations with read/write permissions. This allows an unprivileged local attacker to read or modify live kernel objects, bypass KASLR, and escalate privileges to SYSTEM.

Critical Impact

Local attackers can leverage this vulnerability to achieve arbitrary kernel memory read/write within the exposed page, enabling KASLR bypass, kernel object corruption, and full SYSTEM-level privilege escalation.

Affected Products

• VB-Audio Matrix (versions 1.0.2.2 and earlier)
• VB-Audio Matrix Coconut (versions 2.0.2.2 and earlier)
• VBMatrix VAIO virtual audio driver (vbmatrixvaio64*_win10.sys)

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-23763 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-23763

Vulnerability Analysis

This vulnerability is classified under CWE-668 (Exposure of Resource to Wrong Sphere), a category that describes conditions where a resource is made available to the wrong sphere of control. In this case, the VBMatrix VAIO driver exposes kernel-space memory to unprivileged user-mode processes.

The core issue stems from the driver's memory allocation and mapping logic. When the driver receives IOCTL 0x222060, it allocates a small 128-byte buffer from the non-paged pool and maps it to user space. However, because the allocation size is not page-aligned, the entire 4KB (0x1000-byte) kernel page containing the buffer—along with any adjacent non-paged pool allocations—becomes accessible to the user-mode process with full read/write permissions.

This design flaw has severe security implications. An attacker with local access can open a handle to the vulnerable device using the required 0x800 attribute flag, invoke the IOCTL to obtain the kernel memory mapping, and then manipulate live kernel objects present on the exposed page. This enables multiple attack primitives including KASLR bypass through kernel pointer disclosure, arbitrary read/write within the exposed memory region, and corruption of kernel objects to achieve privilege escalation to SYSTEM.

Root Cause

The root cause is improper memory isolation in the driver's IOCTL handler. The driver uses MmMapLockedPagesSpecifyCache to map a non-paged pool buffer to user space without ensuring the allocation is page-aligned. Windows memory management operates at page granularity (4KB), so mapping any portion of a page exposes the entire page. Since the non-paged pool contains critical kernel objects and pointers, exposing adjacent allocations creates a direct path to kernel compromise.

Attack Vector

The attack is executed locally by an unprivileged user with access to the system. The attacker must:

1. Open a device handle to the VBMatrix VAIO driver using the 0x800 attribute flag
2. Send IOCTL 0x222060 to trigger the vulnerable code path
3. Receive the mapped user-space pointer to kernel memory
4. Read kernel pointers to bypass KASLR and identify target objects
5. Write to kernel objects or pointers to achieve arbitrary code execution in kernel mode

The vulnerability mechanism involves the driver's improper use of MDL-based memory mapping. When processing the IOCTL, the driver creates an MDL for a 128-byte buffer but maps the entire containing page to user space. Adjacent kernel allocations on the same page become readable and writable by the attacker. For detailed technical analysis, refer to the GitHub CVE-2026-23763 Research repository and the VulnCheck Advisory.

Detection Methods for CVE-2026-23763

Indicators of Compromise

• Unexpected process handles opened to VBMatrix VAIO driver devices with 0x800 access flags
• Unusual IOCTL 0x222060 calls from non-audio application processes
• Processes attempting to read or write kernel memory regions after driver interaction
• Unexpected SYSTEM-level process spawning following VB-Audio driver activity

Detection Strategies

• Monitor for DeviceIoControl calls targeting VBMatrix driver handles with IOCTL code 0x222060
• Implement kernel-mode detection for suspicious memory mapping operations from audio drivers
• Deploy endpoint detection rules to flag privilege escalation attempts following audio driver interactions
• Use driver integrity monitoring to detect tampering with vbmatrixvaio64*_win10.sys

Monitoring Recommendations

• Enable detailed Windows ETW (Event Tracing for Windows) logging for device driver interactions
• Configure SIEM rules to correlate VB-Audio driver access with subsequent privilege changes
• Monitor for kernel memory access violations or unusual kernel object modifications
• Track process lineage for any SYSTEM processes spawned after VBMatrix driver initialization

How to Mitigate CVE-2026-23763

Immediate Actions Required

• Update VB-Audio Matrix and Matrix Coconut to the latest available versions from the VB-Audio website
• Restrict local access to systems running vulnerable VB-Audio driver versions
• Consider temporarily disabling or uninstalling the vulnerable driver until a patch is applied
• Implement application control policies to prevent unauthorized exploitation tools from executing

Patch Information

Users should check the VB-Audio Forum for updated driver releases that address this vulnerability. The vendor has acknowledged the issue in forum discussions. Ensure you download updates only from official VB-Audio sources.

Workarounds

• Uninstall VB-Audio Matrix or Matrix Coconut software if not essential for operations
• Restrict access to the vulnerable device object using Windows security policies
• Implement strict least-privilege access controls for all local user accounts
• Deploy kernel exploit protection mechanisms such as Microsoft Defender Credential Guard

# Check for vulnerable VB-Audio driver presence
sc query type=driver | findstr /i "vbmatrix"

# List loaded drivers to identify vulnerable versions
driverquery /v | findstr /i "vbmatrix"