CVE-2026-23761 is a vulnerability in VB-Audio Software's Voicemeeter (Standard), Voicemeeter Banana, Voicemeeter Potato, and VB-Audio Matrix products affecting their virtual audio drivers. The issue arises when a handle is opened with a special file attribute, causing the driver to improperly initialize the FILE_OBJECT->FsContext field to a non-pointer magic value. If subsequent operations are forwarded down the audio driver stack (e.g., via PortCls to ks.sys), the invalid FsContext pointer can be dereferenced, resulting in a kernel crash (BSoD) with SYSTEM_SERVICE_EXCEPTION and STATUS_ACCESS_VIOLATION. This vulnerability enables a local unprivileged user to trigger a denial-of-service condition on Windows systems running affected driver versions. The CVSS 4.0 vector indicates local attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability.

The vulnerability allows a local unprivileged user to cause a denial-of-service by triggering a kernel crash (Blue Screen of Death) on affected Windows systems running vulnerable versions of VB-Audio's virtual audio drivers. This results in system instability and potential disruption of audio services. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor VB-Audio Software's advisories for updates. Until a fix is available, restricting local unprivileged user access to affected systems may reduce risk. No vendor advisory states that no action is required or that the issue is mitigated.