VB‑Audio Matrix and Matrix Coconut drivers contain a flaw in the vbmatrixvaio64.sys kernel device. The driver allocates a 128‑byte buffer in non‑paged pool and, when an attacker sends IOCTL 0x222060, maps that buffer into user space with MmMapLockedPagesSpecifyCache. Because the allocation size is not page aligned, the mapping exposes the entire 4 KiB kernel page, leaking adjacent non‑paged pool objects. An attacker with local access can read or write kernel memory on that page, corrupt kernel objects, bypass KASLR, and ultimately gain SYSTEM privileges. This is an improper access control weakness (CWE‑668).

VB‑Audio Software Matrix (versions ending in 1.0.2.2 and earlier) and Matrix Coconut (versions ending in 2.0.2.2 and earlier) on Windows are affected. The vulnerability is limited to the driver vbmatrixvaio64*_win10.sys.

The CVSS score of 8.5 indicates high severity, but the EPSS score is less than 1 %, showing a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local execution, the ability to open the driver with the 0x800 flag, and to invoke the specific IOCTL. Once executed, the kernel page is mapped into user space, providing arbitrary read/write to that page, allowing manipulation of kernel pointers, corruption of objects, and escalation to SYSTEM.