CVE-2026-10046: Out-of-bounds write in Napoca BIOS INT 0x15 E820 memory map handler (VA-13905)

Synopsis

An out-of-bounds write vulnerability exists in the Bitdefender Napoca bare-metal hypervisor, specifically in the BIOS INT 0x15 E820 memory map handler. An attacker with a low-privilege account and local access to a guest operating system running in real mode can trigger the flaw by issuing a crafted INT 0x15 call with specific register values, causing up to 20 bytes to be written past the end of the hypervisor's RealModeMemory heap buffer. Successful exploitation gives the attacker read access to sensitive hypervisor memory, the ability to corrupt hypervisor heap data, and the potential to disrupt or take control of the hypervisor process. No fix versions have been published; HarborGuard tracks this advisory for any upstream patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable handler is required.

• AuthenticationRequired

  Any low-privilege account on the guest is sufficient to invoke the crafted INT 0x15 call.

• Victim interactionNot required

  No victim action or social engineering is needed; the attacker triggers the flaw directly.

• Attack complexityDetail

  The exploit is reliable and condition-free: specific register values are publicly documented in the CVE, and no race condition or memory-layout dependency must be satisfied.

Blast Radius

• Reads hypervisor heap memory adjacent to the RealModeMemory buffer, exposing internal hypervisor data structures and potentially sensitive guest or host memory contents.
• Writes up to 20 bytes of attacker-influenced data past the end of the RealModeMemory allocation, corrupting hypervisor heap metadata or adjacent data.
• Heap corruption opens a path to redirecting hypervisor execution flow, which breaks the isolation boundary between the guest and the bare-metal hypervisor layer.