Which versions of Bitdefender Napoca are affected by CVE-2026-10046?

Bitdefender Napoca bare-metal hypervisor contains a critical guest-to-host escape vulnerability (CVE-2026-10046, CVSS 8.5) that allows malicious guest VMs to corrupt hypervisor memory and break…

How to fix or mitigate CVE-2026-10046?

Within 24 hours: Inventory all active Bitdefender Napoca deployments and document business criticality. Within 7 days: Confirm EOL status with Bitdefender; evaluate availability of extended support or vendor guidance; initiate hypervisor migration planning to a maintained solution (KVM, Hyper-V, VMware ESXi). Within 30 days: Establish formal decommissioning or replacement timeline; implement interim isolation controls restricting guest VM deployment to trusted, internally-vetted images only.

Bitdefender Napoca CVE-2026-10046

Q: What is the CVSS score of CVE-2026-10046?

CVE-2026-10046 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33943 HIGH

Out-of-bounds Write (CWE-787)

2026-06-02 Bitdefender

GHSA-mpc3-vg75-whww

Memory Corruption Buffer Overflow Napoca Bare Metal Hypervisor

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 18:07 vuln.today

CVSS changed

Jun 02, 2026 - 16:22 NVD

8.5 (HIGH)

CVE Published

Jun 02, 2026 - 14:16 nvd

HIGH 8.5

CVE Published

Jun 02, 2026 - 14:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocation. A malicious guest operating in real mode can trigger the issue by invoking INT 0x15 with AX=0xE820, EDX=0x534D4150, ECX greater than or equal to 20, EBX=0, ES=0xFFFF, and EDI=0xFFFF. This can cause a write of up to 20 bytes past the end of the RealModeMemory buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.

AnalysisAI

Out-of-bounds heap write in the Bitdefender Napoca bare-metal hypervisor lets a malicious guest VM operating in real mode corrupt hypervisor memory through a crafted INT 0x15/E820 BIOS call, potentially enabling guest-to-host escape. The flaw resides in napoca/guests/bios_handlers.c, which computes a write offset from attacker-controlled ES:EDI register values without bounds checking against the 1MB RealModeMemory buffer. No public exploit identified at time of analysis, and CISA SSVC classifies exploitation status as 'none' - but the product is end-of-life and unsupported, raising the long-term risk profile.

Technical ContextAI

Napoca is Bitdefender's Type-1 bare-metal hypervisor that intercepts legacy BIOS services for guest VMs running in real mode. The vulnerable component emulates the BIOS INT 0x15 function AX=0xE820, the standard System Memory Map query interface used by bootloaders and early OS code to enumerate physical memory regions. The handler writes up to 20 bytes of E820 entry data into a per-guest 1MB RealModeMemory scratch buffer, but the destination is computed by combining the guest's segmented ES:EDI pointer (ES=0xFFFF, EDI=0xFFFF yields a 20-bit linear address far beyond the buffer). The CWE-787 (Out-of-bounds Write) root cause is a missing bounds check on the segment-translated linear address before the memcpy/structured write into the hypervisor heap, allowing controlled corruption of adjacent allocator metadata or hypervisor state. The affected CPE is cpe:2.3:a:bitdefender:napoca_bare-metal_hypervisor:*:*:*:*:*:*:*:*, covering all versions per the EUVD record.

RemediationAI

No vendor-released patch identified at time of analysis - Bitdefender has declared Napoca end-of-life and unsupported, so no fixed version will be published. The only durable remediation is migration off Napoca to a currently supported Type-1 hypervisor (e.g., a vendor-supported KVM/Xen/Hyper-V/ESXi stack); plan replacement of any host still running Napoca and treat continued use as accepting an unpatched guest-escape primitive. As a stopgap until migration, restrict which workloads can run on Napoca to fully trusted guests under your administrative control, since exploitation requires the attacker to execute code inside a guest VM - do not run untrusted or multi-tenant workloads on affected hosts. Network-isolate Napoca hosts so a compromised guest cannot be the pivot point into a broader environment, and increase monitoring of guest boot-time BIOS service usage where feasible (trade-off: BIOS INT 0x15/E820 is invoked by virtually every legitimate guest bootloader, so signal-to-noise will be poor). Consult the Bitdefender advisory at https://www.bitdefender.com/consumer/support/security-advisories/out-of-bounds-write-in-napoca-bios-int-0x15-e820-memory-map-handler-va-13905 for any vendor-specific guidance.