EUVD-2026-33943
GHSA-mpc3-vg75-whww
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (Bitdefender) · only source for this CVE.
CVSS VectorVendor: Bitdefender
Lifecycle Timeline
4DescriptionCVE.org
Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocation. A malicious guest operating in real mode can trigger the issue by invoking INT 0x15 with AX=0xE820, EDX=0x534D4150, ECX greater than or equal to 20, EBX=0, ES=0xFFFF, and EDI=0xFFFF. This can cause a write of up to 20 bytes past the end of the RealModeMemory buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.
AnalysisAI
Out-of-bounds heap write in the Bitdefender Napoca bare-metal hypervisor lets a malicious guest VM operating in real mode corrupt hypervisor memory through a crafted INT 0x15/E820 BIOS call, potentially enabling guest-to-host escape. The flaw resides in napoca/guests/bios_handlers.c, which computes a write offset from attacker-controlled ES:EDI register values without bounds checking against the 1MB RealModeMemory buffer. No public exploit identified at time of analysis, and CISA SSVC classifies exploitation status as 'none' - but the product is end-of-life and unsupported, raising the long-term risk profile.
Technical ContextAI
Napoca is Bitdefender's Type-1 bare-metal hypervisor that intercepts legacy BIOS services for guest VMs running in real mode. The vulnerable component emulates the BIOS INT 0x15 function AX=0xE820, the standard System Memory Map query interface used by bootloaders and early OS code to enumerate physical memory regions. The handler writes up to 20 bytes of E820 entry data into a per-guest 1MB RealModeMemory scratch buffer, but the destination is computed by combining the guest's segmented ES:EDI pointer (ES=0xFFFF, EDI=0xFFFF yields a 20-bit linear address far beyond the buffer). The CWE-787 (Out-of-bounds Write) root cause is a missing bounds check on the segment-translated linear address before the memcpy/structured write into the hypervisor heap, allowing controlled corruption of adjacent allocator metadata or hypervisor state. The affected CPE is cpe:2.3:a:bitdefender:napoca_bare-metal_hypervisor:*:*:*:*:*:*:*:*, covering all versions per the EUVD record.
RemediationAI
No vendor-released patch identified at time of analysis - Bitdefender has declared Napoca end-of-life and unsupported, so no fixed version will be published. The only durable remediation is migration off Napoca to a currently supported Type-1 hypervisor (e.g., a vendor-supported KVM/Xen/Hyper-V/ESXi stack); plan replacement of any host still running Napoca and treat continued use as accepting an unpatched guest-escape primitive. As a stopgap until migration, restrict which workloads can run on Napoca to fully trusted guests under your administrative control, since exploitation requires the attacker to execute code inside a guest VM - do not run untrusted or multi-tenant workloads on affected hosts. Network-isolate Napoca hosts so a compromised guest cannot be the pivot point into a broader environment, and increase monitoring of guest boot-time BIOS service usage where feasible (trade-off: BIOS INT 0x15/E820 is invoked by virtually every legitimate guest bootloader, so signal-to-noise will be poor). Consult the Bitdefender advisory at https://www.bitdefender.com/consumer/support/security-advisories/out-of-bounds-write-in-napoca-bios-int-0x15-e820-memory-map-handler-va-13905 for any vendor-specific guidance.
More in Bitdefender
View allThe Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installatio
An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linu
Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet
Improper Access Control vulnerability in the patchesUpdate API as implemented in Bitdefender Endpoint Security Tools for
A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely
A host whitelist parser issue in the proxy service implemented in the GravityZone Update Server allows an attacker to ca
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today