CVE-2026-105051 in Denuvo Anti-Tamper
Summary
by MITRE • 10/03/2026
Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The vulnerability identified in Denuvo Anti-Tamper software, specifically affecting versions up to March 4, 2026, centers on a critical flaw within the hypervisor presence detection mechanism. This component is designed to ensure that protected applications are running in an environment free from unauthorized virtualization layers, which are often used by reverse engineers and cheat developers to manipulate game logic or extract sensitive data. The core technical failure lies in how the software interacts with CPUID instructions during its security checks. Specifically, Denuvo relies on intercepting these CPUID calls via kernel-mode drivers such as SimpleSvm.sys for AMD processors and hyperkd.sys along with hyperhv.dll for Intel processors to determine if a hypervisor is active. The flaw allows an attacker to bypass this check by manipulating the response returned from the intercepted CPUID instruction, effectively masking the presence of a virtual machine or debugging environment from the anti-tamper system.
From a technical perspective, this vulnerability exploits the trust placed in hardware-reported features without sufficient verification against other system states. When Denuvo queries the processor for hypervisor-related flags via CPUID, it expects specific bit patterns that indicate whether virtualization extensions are enabled and active at the current privilege level. By hooking or intercepting these calls through the aforementioned drivers, an attacker can return false positive values that suggest no hypervisor is present, even when one is actively running in the background. This technique leverages the fact that CPUID interception is a common method for both legitimate virtualization software and malicious tools to hide their presence. The vulnerability essentially creates a blind spot where the anti-tamper solution believes it is operating on bare metal hardware while actually being executed within a controlled, emulated environment designed to facilitate exploitation or cheating.
The operational impact of this flaw is significant for digital rights management integrity and fair play in protected software ecosystems. Attackers can utilize tools like Cheat Engine, custom debuggers, or modified virtual machines to inject code, modify memory values, or bypass license verification checks without triggering Denuvo's anti-debugging or anti-tamper alerts. This undermines the primary purpose of the protection layer, allowing for unauthorized modifications that can range from simple gameplay advantages in video games to more severe compromises in enterprise software where intellectual property theft is a concern. The ability to hide hypervisor presence also facilitates further attacks such as kernel-level rootkit installation or persistent malware deployment, as the security software fails to detect the underlying virtualization infrastructure often used by advanced persistent threats.
This vulnerability aligns with CWE-749, which describes exposure of a system to unintended control state, specifically regarding how input validation and environment checks are bypassed through manipulation of hardware-reported data. In terms of offensive cybersecurity frameworks, this technique maps directly to MITRE ATT&CK techniques T1057, Process Injection, and more critically T1497, Virtualization/Sandbox Evasion, where adversaries use virtual environments to avoid detection by security solutions that rely on static environmental checks. The specific method of intercepting CPUID calls is a known evasion tactic used in both commercial cheat development and advanced malware campaigns to maintain stealth against heuristic analysis tools.
Mitigation strategies for this vulnerability primarily involve software updates from the vendor, as Denuvo likely addresses the flaw by implementing more robust verification methods that do not rely solely on intercepted CPUID responses. Developers should consider supplementing hypervisor detection with additional checks such as timing attacks, which measure execution speed discrepancies between bare metal and virtualized environments, or checking for specific artifacts left behind by common debugging tools. Furthermore, integrating multiple layers of security controls, including integrity verification of the operating system kernel and monitoring for unauthorized driver loads, can help detect attempts to manipulate these low-level hardware interfaces. Until patches are applied, users should remain cautious about running protected software in known virtualized environments or using third-party overlays that may interact with CPUID instructions.