The vulnerability lies in Syscall 15 (MemoryMapRange), which permits a Ring 3 user-mode process to map any virtual address range without checking against protected kernel regions. This flaw means an attacker can map critical structures such as the IDT, GDT, TSS, or page tables, and then overwrite kernel interrupt handlers. The result is that the attacker can hijack kernel control flow and gain elevated privileges, effectively bypassing isolation between user and kernel space.

The affected system is NovumOS, produced by MinecAnton209. All releases prior to 0.24 are vulnerable; the patch that fixes the issue was introduced in version 0.24.

The CVSS score of 9 indicates a high severity of impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The exploit requires local execution and relies on the ability to invoke syscall 15 from a user-level process. Because the attacker can manipulate kernel interrupt handlers, a successful attack leads to complete privilege escalation, allowing unrestricted control over the system.