Denuvo Anti-Tamper CVE-2026-105051

Exploitation requires the attacker to already have local administrative/kernel-level control of the machine in order to load a hypervisor driver (SimpleSvm.sys on AMD, or hyperkd.sys and hyperhv.dll on Intel) that intercepts the CPUID instruction and spoofs hypervisor-absence results back to Denuvo's detection logic. Limiting factors: no remote vector (AV:L), high privileges required (PR:H - kernel driver loading), and high attack complexity (AC:H, platform-specific AMD/Intel tooling). In practice the 'attacker' is the operator of the host defeating DRM on their own system, so there is no third-party victim or escalation beyond the anti-tamper check itself.

This is a genuinely low-priority issue, and the signals are consistent in pointing that way. The provided CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N, base 1.9) describes a local attack requiring high privileges and high complexity, with no confidentiality or availability impact and only low integrity impact - the 'integrity' being Denuvo's own hypervisor-presence check, not the host OS. No EPSS score was supplied in the input and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation. The GitHub reference ('hypervisor-crack-audit') strongly suggests public analysis/exploit code exists, but no formal POC flag was provided, so this is inferred rather than confirmed. Critically, CWE-348 (reliance on a less-trusted source) and the mechanism make clear this is a DRM/anti-tamper circumvention performed by the operator of their own machine - not a vector for an external attacker to compromise a victim. There is no SSVC decision data in the input. Net: this is a low-CVSS, low-real-risk DRM bypass of interest to game publishers and Denuvo/Irdeto, not an enterprise security priority.

A user with local administrative/kernel privileges on their own system loads a custom hypervisor (SimpleSvm.sys on AMD, or hyperkd.sys/hyperhv.dll on Intel) that intercepts the CPUID instruction to spoof its results, hiding the hypervisor from Denuvo's presence check. This lets a Denuvo-protected game run under virtualization or instrumentation the anti-tamper is designed to block. Public audit/exploit code appears to be referenced via the linked GitHub repository, though no formal POC flag was provided in the input.