Bitdefender Napoca bare-metal hypervisor Malicious Guest Operatingreal Mode bios_handlers.c out-of-bounds write

Summaryinfo

A vulnerability has been found in Bitdefender Napoca bare-metal hypervisor and classified as critical. The impacted element is an unknown function of the file napoca/guests/bios_handlers.c of the component Malicious Guest Operatingreal Mode. The manipulation leads to out-of-bounds write. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is traded as CVE-2026-10046. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Bitdefender Napoca bare-metal hypervisor (the affected version unknown) and classified as critical. This issue affects an unknown part of the file napoca/guests/bios_handlers.c of the component Malicious Guest Operatingreal Mode. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocation. A malicious guest operating in real mode can trigger the issue by invoking INT 0x15 with AX=0xE820, EDX=0x534D4150, ECX greater than or equal to 20, EBX=0, ES=0xFFFF, and EDI=0xFFFF. This can cause a write of up to 20 bytes past the end of the RealModeMemory buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.

The weakness was shared by Sebastián Alba Vives. It is possible to read the advisory at bitdefender.com. The identification of this vulnerability is CVE-2026-10046 since 05/29/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/08/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Bitdefender

Name

• Napoca bare-metal hypervisor

License

• commercial

Support

• end of life

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion