CVE-2026-23764: VB-Audio Voicemeeter DOS Vulnerability

CVE-2026-23764 Overview

CVE-2026-23764 is a local denial-of-service vulnerability affecting VB-Audio virtual audio drivers used by Voicemeeter, Voicemeeter Banana, Voicemeeter Potato, VB-Audio Matrix, and Matrix Coconut products. The vulnerability exists in multiple driver files including vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, vbaudio_vmauxvaio*.sys, vbaudio_vmvaio*.sys, and vbaudio_vmvaio3*.sys. An unprivileged local attacker can exploit this flaw to trigger a kernel crash (BSoD), resulting in system-wide denial of service on affected Windows systems.

Critical Impact

Local attackers can cause a kernel crash (PAGE_FAULT_IN_NONPAGED_AREA BSoD) by corrupting memory allocation length values exposed to user space, resulting in complete system denial of service.

Affected Products

• VB-Audio Voicemeeter versions ending in 1.1.1.9 and earlier
• VB-Audio Voicemeeter Banana versions ending in 2.1.1.9 and earlier
• VB-Audio Voicemeeter Potato versions ending in 3.1.1.9 and earlier
• VB-Audio Matrix versions ending in 1.0.2.2 and earlier
• VB-Audio Matrix Coconut versions ending in 2.0.2.2 and earlier

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-23764 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-23764

Vulnerability Analysis

This vulnerability is classified under CWE-823 (Use of Out-of-range Pointer Offset). The affected VB-Audio virtual audio drivers allocate non-paged pool memory and map it into user space, inadvertently exposing a length value associated with the allocation. This design flaw allows an unprivileged local attacker to modify the length value from user space.

When subsequent IOCTL operations are performed, the corrupted length value is passed directly to the IoAllocateMdl kernel function without adequate integrity validation. The kernel then attempts to build and map a Memory Descriptor List (MDL) using the corrupted length, leading to memory access violations. This results in a system crash, typically manifesting as the PAGE_FAULT_IN_NONPAGED_AREA Blue Screen of Death (BSoD).

The vulnerability impacts system availability but does not allow for code execution, information disclosure, or data modification. The local attack vector requirement limits the scope of exploitation to users who already have local access to the affected system.

Root Cause

The root cause of this vulnerability stems from improper trust of user-controlled data in kernel-mode driver operations. Specifically, the VB-Audio drivers expose memory allocation metadata (length values) to user space through memory-mapped regions. The drivers then fail to implement adequate integrity checks before using this potentially corrupted length value in critical kernel operations like IoAllocateMdl.

This violates the security principle of never trusting user-space data in kernel-mode operations. The length parameter should either be stored securely in kernel-only memory or validated against expected bounds before being used in MDL allocation.

Attack Vector

The attack requires local access to a Windows system with the vulnerable VB-Audio drivers installed. An unprivileged local attacker can exploit this vulnerability through the following mechanism:

1. The attacker identifies the memory region mapped from kernel space that contains the allocation length value
2. The attacker modifies this length value to an out-of-range or corrupted value
3. The attacker triggers an IOCTL operation that causes the driver to use the corrupted length
4. The driver passes the corrupted length to IoAllocateMdl without validation
5. The kernel crashes when attempting to build or map the MDL with invalid parameters

No user interaction is required once the attacker has local access. The vulnerability does not require elevated privileges to exploit. For detailed technical analysis, see the GitHub security research repository and the VulnCheck advisory.

Detection Methods for CVE-2026-23764

Indicators of Compromise

• System crash logs showing PAGE_FAULT_IN_NONPAGED_AREA BSoD with call stacks involving vbvoicemeetervaio64*.sys, vbmatrixvaio64*.sys, or related VB-Audio driver files
• Windows Event Viewer entries indicating driver-related system failures in the VB-Audio virtual audio drivers
• Memory dump analysis revealing abnormal IoAllocateMdl calls with invalid length parameters originating from VB-Audio drivers

Detection Strategies

• Monitor Windows crash dumps (minidumps and kernel dumps) for BSoD events attributed to VB-Audio driver files
• Implement endpoint detection rules to identify processes attempting to interact with VB-Audio driver IOCTLs in suspicious patterns
• Deploy driver integrity monitoring to detect attempts to tamper with memory-mapped regions associated with VB-Audio drivers
• Configure Windows Driver Verifier to enable enhanced validation for the affected driver files during testing

Monitoring Recommendations

• Enable Windows Error Reporting (WER) to capture detailed crash data and identify recurring BSoD events involving VB-Audio drivers
• Utilize SentinelOne kernel-level visibility to monitor driver IOCTL activity and detect anomalous memory manipulation attempts
• Implement centralized logging for Windows system stability events to quickly identify patterns of exploitation attempts across multiple endpoints

How to Mitigate CVE-2026-23764

Immediate Actions Required

• Inventory all systems with VB-Audio Voicemeeter, Voicemeeter Banana, Voicemeeter Potato, VB-Audio Matrix, or Matrix Coconut installed
• Update affected VB-Audio products to the latest available versions from the official VB-Audio website
• Consider temporarily uninstalling or disabling the vulnerable virtual audio drivers on critical systems if updates are not yet available
• Monitor vendor communication channels including the VB-Audio Forum for patch announcements and security updates

Patch Information

Organizations should check the VB-Audio official website for updated versions of the affected products. The VB-Audio Forum discussions provide additional context regarding the vulnerability and remediation status. Ensure all VB-Audio products are updated to versions newer than:

• Voicemeeter: versions after 1.1.1.9
• Voicemeeter Banana: versions after 2.1.1.9
• Voicemeeter Potato: versions after 3.1.1.9
• VB-Audio Matrix: versions after 1.0.2.2
• Matrix Coconut: versions after 2.0.2.2

Workarounds

• If updates are not available, consider removing the VB-Audio virtual audio drivers from systems where they are not essential for operations
• Restrict local access to affected systems to trusted users only, as the vulnerability requires local access to exploit
• Implement application whitelisting to prevent unauthorized programs from interacting with the vulnerable drivers
• Use system hardening configurations to limit user-space access to driver memory regions where possible

# Check installed VB-Audio driver versions on Windows
# Run in PowerShell with administrative privileges
Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.DeviceName -like "*VB-Audio*" -or $_.DeviceName -like "*Voicemeeter*"} | Select-Object DeviceName, DriverVersion, Manufacturer