CVE-2026-10046: Bitdefender Napoca Hypervisor Out-of-Bounds Write Vulnerability

Technical summary

CVE-2026-10046 is an out-of-bounds write vulnerability in Bitdefender Napoca's real-mode BIOS interrupt handler. The vulnerability resides in napoca/guests/bios_handlers.c, specifically in the INT 0x15 / E820 memory map handler. The handler calculates a destination offset within the guest's RealModeMemory buffer by combining ES (segment) and EDI (offset) register values supplied by the guest without performing bounds validation. When a guest executes INT 0x15 with AX=0xE820, EDX=0x534D4150, ECX ≥ 20, EBX=0, ES=0xFFFF, and EDI=0xFFFF, the computed address points beyond the 1MB RealModeMemory allocation. This permits writing up to 20 bytes into adjacent hypervisor heap memory. The vulnerability requires local guest access and low privilege, classified as CWE-787 (out-of-bounds write).

Business impact

Organizations running Bitdefender Napoca face a critical isolation breach. A malicious guest can compromise the hypervisor's memory integrity, potentially enabling escalation to arbitrary code execution within the hypervisor context. This undermines the security assumption that hypervisors isolate and control guest workloads. If Napoca is used to partition security-sensitive operations or enforce compliance boundaries, a guest escape or hypervisor compromise could bypass those protections entirely. The end-of-life status means no vendor patches will be released, leaving affected deployments in a perpetual vulnerable state unless decommissioned or replaced.

Affected systems

Bitdefender Napoca bare-metal hypervisor in all versions is affected. Since the product is end-of-life and unsupported at the time of CVE assignment, no current versions are receiving security updates. Any organization still operating Napoca—whether in production or legacy environments—is potentially affected if guest systems are not fully isolated or trusted.

Exploitability

Exploitability is straightforward for an attacker with guest-level access. The attack requires only the ability to execute real-mode code or invoke BIOS interrupts from a guest environment and does not require elevated hypervisor privileges. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local attack vector, low attack complexity, low privilege requirement, and high impact across confidentiality, integrity, and availability. The exploit does not require user interaction. No known public exploit code is documented in the KEV catalog, but the technical barrier to weaponization is low given the deterministic nature of the flaw.

Remediation

No vendor patch will be released for Napoca due to end-of-life status. Organizations must pursue one of two paths: (1) decommission or migrate away from Napoca to a supported alternative hypervisor, or (2) implement strict isolation measures to prevent guest systems from executing untrusted code or invoking BIOS interrupts. Isolation may include disabling real-mode execution where possible, enforcing strict code integrity policies on guest images, and network segmentation to limit lateral movement if a guest is compromised.

Patch guidance

No official patch is available from Bitdefender. Verify current Napoca deployment status with your infrastructure team immediately. If Napoca remains in production, initiate a migration plan to a vendor-supported hypervisor platform (such as Xen, KVM, or commercial alternatives). Coordinate the transition with application and compliance teams to ensure continuity. Do not rely on workarounds; the absence of vendor support means future vulnerabilities will remain unaddressed.

Detection guidance

Monitor hypervisor logs for anomalous real-mode interrupt handler activity, particularly INT 0x15 calls with the specific register signatures noted in the vulnerability description (AX=0xE820, EDX=0x534D4150, ES=0xFFFF, EDI=0xFFFF). Use kernel/hypervisor debuggers to instrument bios_handlers.c entry points if feasible in your test environment. Heap memory canaries or guard pages placed adjacent to RealModeMemory may catch exploitation attempts, though production deployment of such instrumentation should be validated separately. Asset inventory scans should identify any remaining Napoca instances for accelerated remediation.

Why prioritize this

Prioritize this vulnerability at maximum severity. Although it requires local guest access, the impact is critical—it enables hypervisor compromise and complete guest isolation bypass. The end-of-life status eliminates any prospect of vendor remediation, making remediation through migration or decommissioning mandatory rather than discretionary. Organizations still operating Napoca are in an actively unsupported state that compounds risk.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of local attack vector, low complexity, and high impact across confidentiality, integrity, and availability. While the attack requires local privilege (PR:L), the barrier to obtaining guest-level access in many environments is modest, especially if guest images are not fully controlled or validated. The high impact score is warranted because a successful hypervisor heap corruption can lead to arbitrary code execution within the hypervisor, effectively compromising all guest isolation. The end-of-life status elevates operational risk beyond the CVSS score alone.

Frequently asked questions