NovumOS, a custom 32‑bit operating system written in Zig and x86 assembly, was found to allow any user‑mode (Ring 3) process to execute code with kernel privileges by exploiting Syscall 12 (JumpToUser). The syscall accepts an arbitrary entry point address from user‑space registers without validation, enabling the attacker to redirect program flow to arbitrary kernel addresses. This results in local privilege escalation and full system compromise. The flaw is rooted in improper input validation (CWE‑20) and privileged access enforcement (CWE‑269).

The affected vendor is MinecAnton209, publisher of NovumOS. Versions prior to 0.24 are vulnerable. The operating system runs on 32‑bit x86 hardware and is intended for specialized embedded or experimental deployments. Any installation that still uses the pre‑0.24 code base is exposed.

The CVSS score of 9.4 categorizes this flaw as critical. Because it is a local privilege escalation without network or remote code execution vectors, the EPSS score is unavailable, and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers with access to a user‑level process or the ability to execute code in user mode can manually trigger Syscall 12 with a crafted entry address, thereby jumping to the kernel and achieving arbitrary code execution in Ring 0. There are no publicly documented constraints beyond the existence of a user/process in the system; the vulnerability can be exploited by any Ring 3 program that can control its registers.