CVE-2026-105051

Received Received - Intake

Denuvo Anti-Tamper Hypervisor Bypass via CPUID Interception

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: MITRE

Description

Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys and hyperhv.dll on Intel).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-02

Generated

2026-10-03

AI Q&A

2026-10-03

EPSS Evaluated

N/A

NVD

CVE-2026-105051

EUVD

EUVD-2026-91848

Affected Vendors & Products

Vendor	Product	Version / Range
denuvo	anti-tamper	to 2026-03-04 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-348	The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

Executive Summary

Denuvo Anti-Tamper through 2026-03-04 has a flaw where its hypervisor presence check can be bypassed by intercepting CPUID instructions. This affects SimpleSvm.sys on AMD systems and hyperkd.sys and hyperhv.dll on Intel systems.

Detection Guidance

Detection may involve checking for unusual CPUID interception behavior or hypervisor-related driver activity. Monitor SimpleSvm.sys (AMD) or hyperkd.sys/hyperhv.dll (Intel) for unexpected modifications or processes. Use system monitoring tools to inspect CPUID calls and driver interactions.

Impact Analysis

This vulnerability allows attackers to bypass anti-tamper protections, potentially enabling unauthorized access or modification of protected software. It has a low impact on confidentiality, integrity, and availability per CVSS.

Compliance Impact

The vulnerability allows bypass of hypervisor checks via CPUID interception, which could potentially enable unauthorized access or tampering with protected systems. This may impact compliance with standards requiring hypervisor integrity, such as sections of GDPR or HIPAA that mandate secure processing environments.

Mitigation Strategies

Update Denuvo Anti-Tamper to the latest version if available. Disable or remove affected drivers (SimpleSvm.sys, hyperkd.sys, hyperhv.dll) if not required. Restrict access to these drivers and monitor for unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-105051. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70