CVE-2026-10047
Out-of-Bounds Write in Bitdefender Napoca Hypervisor
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Bitdefender
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bitdefender | napoca | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
The Bitdefender Napoca product containing this vulnerability is end-of-life and unsupported, with no fix planned.
The recommended immediate mitigation step is to discontinue use of the Bitdefender Napoca bare-metal hypervisor to avoid exposure to this high severity vulnerability.
How can this vulnerability impact me? :
This vulnerability can lead to memory corruption within the hypervisor heap due to an out-of-bounds write. Such corruption may allow an attacker with limited privileges to execute arbitrary code, cause denial of service, or compromise the integrity and stability of the hypervisor environment.
Since the affected product is end-of-life and unsupported, no fix is planned, increasing the risk for users who continue to use it.
Can you explain this vulnerability to me?
CVE-2026-10047 is an out-of-bounds write vulnerability in the Bitdefender Napoca bare-metal hypervisor. It occurs in the real-mode hook handler, where a guest-controlled SS:SP-derived offset is used as an index into a 1MB RealModeMemory buffer without proper bounds checking.
Specifically, when SS is set to 0xFFFF and ESP to 0xFFFF, the calculated offset can reach 0x10FFEF, which exceeds the buffer size by 65,519 bytes. This allows the IRET frame push operation to write beyond the end of the buffer into the hypervisor heap, potentially corrupting memory.