CVE-2026-10047: Bitdefender Napoca Out-of-Bounds Write in Real-Mode Handler

Technical summary

CVE-2026-10047 is an out-of-bounds write vulnerability in Napoca's real-mode hook handler (napoca/kernel/handler.c). The vulnerability arises because the handler derives a buffer index from guest-controlled SS:SP register values without performing bounds validation against the 1MB RealModeMemory buffer. A crafted guest can set SS=0xFFFF and ESP=0xFFFF to generate an offset of 0x10FFEF, which exceeds the buffer's 1MB limit by 65,519 bytes. When the handler executes an IRET frame push operation, the write extends into the adjacent hypervisor heap, enabling arbitrary heap corruption. The flaw is classified as CWE-787 (out-of-bounds write).

Business impact

Organizations relying on Napoca for virtualization security are exposed to local privilege escalation and potential guest-to-hypervisor escape scenarios. A compromised guest VM can corrupt hypervisor memory, destabilizing other VMs on the same physical host or establishing persistence mechanisms. Given that Napoca is end-of-life and unsupported, no vendor patches are forthcoming, making this a permanent risk unless deployments are decommissioned or isolated. Affected enterprises should assess whether Napoca remains in production and plan migration strategies accordingly.

Affected systems

Bitdefender Napoca bare-metal hypervisor. The product is explicitly end-of-life and no longer receives vendor support. Any deployed instance of Napoca is vulnerable; no patched versions exist.

Exploitability

The vulnerability requires local access (a compromised or malicious guest VM) and low privilege (the attacker operates within the guest context). Exploitation is straightforward: set guest registers to trigger an out-of-bounds index, then execute an instruction sequence that causes the handler to write the IRET frame. No complex user interaction is required. The attack surface is directly accessible from any guest VM, making this a high-risk flaw for multi-tenant hypervisor environments. Exploit code is not known to be in active circulation, but the simplicity of the trigger suggests weaponization is feasible.

Remediation

Because Napoca is end-of-life, Bitdefender will not release patches. Organizations must migrate to a supported hypervisor platform (e.g., newer Bitdefender offerings or alternative virtualization stacks) or decommission Napoca deployments. Interim risk mitigation includes: strict VM isolation (limiting guest capabilities), air-gapping Napoca hosts from untrusted networks, and restricting guest creation to trusted sources. These measures reduce exposure but do not eliminate the underlying vulnerability.

Patch guidance

No patch is available from Bitdefender for this end-of-life product. Verify your inventory to identify all Napoca deployments. If Napoca is still in use, contact Bitdefender support to discuss migration pathways to supported alternatives. Document the timeline for decommissioning or replacement in your asset management system.

Detection guidance

Detection at runtime is difficult because the vulnerability occurs within the hypervisor's real-mode handler logic. Focus detection efforts on identifying Napoca deployments via asset discovery tools (check for the presence of Napoca hypervisor binaries and configuration). Inspect VM guest OS logs for unusual crashes or memory protection faults that might signal heap corruption. Monitor host-level kernel logs for unexpected hypervisor faults. If security monitoring tools are deployed within guest VMs, configure them to alert on abnormal register manipulation patterns that target SS and SP values. Note that no KEV active exploitation evidence has been reported as of the CVE publication date.

Why prioritize this

Although this is a HIGH-severity vulnerability with a CVSS score of 7.8, prioritization depends on whether Napoca remains in active use in your environment. If you have no Napoca deployments, risk is zero. If Napoca is present, this is a critical finding because: (1) local guest-to-hypervisor escape is highly damaging in multi-tenant environments, (2) no patch is available, and (3) remediation requires architectural changes (migration or decommission). Prioritize inventory and migration planning over all other Napoca-related tasks.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects: Attack Vector = Local (AV:L, requires guest access), Attack Complexity = Low (AC:L, straightforward trigger), Privileges Required = Low (PR:L, guest user level suffices), User Interaction = None (UI:N, no user action needed), and full impact on Confidentiality, Integrity, and Availability (C:H/I:H/A:H). The score does not discount end-of-life status; it reflects the technical severity of the flaw itself. In practice, risk is modulated by whether Napoca is deployed at all.

Frequently asked questions