CVE-2026-23762 affects multiple VB-Audio Software products, including Voicemeeter (Standard, Banana, Potato) and Matrix (Matrix and Matrix Coconut) versions up to specified releases. The vulnerability is rooted in the virtual audio drivers (e.g., vbvoicemeetervaio64*.sys and related drivers) that map non-paged pool memory into user space using the Windows kernel function MmMapLockedPagesSpecifyCache with UserMode access. When the system's virtual address space is exhausted or the mapping fails, MmMapLockedPagesSpecifyCache raises an exception. The drivers do not implement proper exception handling for this scenario, causing the exception to propagate unhandled and crash the kernel, resulting in a Blue Screen of Death (BSoD) with a SYSTEM_SERVICE_EXCEPTION and STATUS_NO_MEMORY error. This flaw can be exploited by any local unprivileged user to cause a denial-of-service condition by forcing the system to crash. The attack requires no privileges, no user interaction, and no network access, limiting the attack vector to local access only. The impact is confined to system availability, with no direct compromise of confidentiality or integrity. No known public exploits or patches exist at this time, but the vulnerability is publicly disclosed with a CVSS 4.0 score of 6.9, indicating a medium risk level.

The primary impact of CVE-2026-23762 is a denial-of-service condition caused by a kernel crash (BSoD) on affected Windows systems running vulnerable VB-Audio Software drivers. This can disrupt audio services and potentially affect critical systems relying on these drivers for audio processing, such as broadcasting, streaming, conferencing, or professional audio production environments. The disruption can lead to operational downtime, loss of productivity, and potential cascading effects if the affected system is part of a larger infrastructure. Since the vulnerability can be triggered by any local user without privileges, it poses a risk in multi-user environments, shared workstations, or systems exposed to untrusted users. However, the lack of remote exploitability and absence of privilege escalation or data compromise limits the overall severity. Organizations with high availability requirements or those using these audio drivers in sensitive environments should consider this a significant risk to system stability.

To mitigate CVE-2026-23762, organizations should: 1) Monitor VB-Audio Software vendor communications closely for patches or updated driver releases addressing this exception handling flaw and apply them promptly once available. 2) Restrict local user access on systems running vulnerable drivers to trusted personnel only, minimizing the risk of unprivileged users triggering the DoS. 3) Implement application whitelisting and endpoint protection controls to prevent unauthorized execution of code that could attempt to exploit this vulnerability. 4) Consider isolating or segmenting systems that require these audio drivers to limit exposure and impact in case of a crash. 5) Regularly audit and monitor system logs for signs of repeated crashes or attempts to exhaust virtual address space. 6) As a temporary workaround, evaluate whether alternative audio drivers or software can replace the vulnerable VB-Audio drivers until a patch is available. 7) Educate users about the risk of local attacks and enforce strict access controls on shared or multi-user systems.