Out-of-bounds Write Vulnerability in Bitdefender Napoca Hypervisor

CVE-2026-10046

What is CVE-2026-10046?

The Bitdefender Napoca bare-metal hypervisor features an out-of-bounds write vulnerability in the BIOS INT 0x15 memory map handler. This flaw allows for unauthorized memory access due to the handler computing a destination offset using guest-controlled ES and EDI register values without proper validation. A malicious guest operating in real mode can exploit this by invoking INT 0x15 with specific register values, resulting in a write operation that exceeds the allocated RealModeMemory. This behavior could lead to data corruption or hijacking of memory resources within the hypervisor, posing significant risks to the hypervisor's integrity and stability.

References