NovumOS, a custom 32-bit OS written in Zig and x86 Assembly, contains an improper privilege management vulnerability (CWE-269) in versions before 0.24. Specifically, Syscall 15 (MemoryMapRange) does not validate virtual address ranges requested by Ring 3 user-mode processes, allowing mapping over critical kernel structures such as the IDT, GDT, TSS, and page tables. Exploiting this, a local attacker can alter kernel interrupt handlers and gain kernel-level privileges. The issue is resolved in NovumOS version 0.24.

Successful exploitation allows a local attacker to escalate privileges from user mode to kernel mode by modifying kernel interrupt handlers. This compromises system integrity and confidentiality, enabling full control over the affected system. The CVSS v3.1 score is 9.0 (critical), reflecting high impact on confidentiality and integrity with no required user interaction and low attack complexity.

Upgrade NovumOS to version 0.24 or later, where this vulnerability is fixed. Since the vendor advisory does not provide additional remediation details, applying the official update is the recommended action. Patch status is confirmed by the vendor stating the issue is fixed in version 0.24.