CVE-2026-10047: Out-of-bounds write in Napoca real-mode hook handler via guest-controlled SS:SP (VA-13905)

Synopsis

An out-of-bounds write vulnerability exists in the Bitdefender Napoca bare-metal hypervisor's real-mode hook handler. A low-privileged guest user can craft SS and SP register values that cause the handler to compute an offset of up to 0x10FFEF into a 1MB buffer, writing an IRET frame 65,519 bytes past the end of that buffer into the hypervisor heap. Successful exploitation gives an attacker full read and write access to hypervisor memory and can crash the hypervisor process entirely. No fix versions have been published; Napoca is end-of-life, and HarborGuard tracks the advisory for any future patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the vulnerable component is required.

• AuthenticationRequired

  A low-privilege account (guest OS user) is sufficient to supply the crafted SS:SP values that trigger the out-of-bounds write.

• Victim interactionNot required

  No action from any other user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race condition, specific memory layout, or environmental prerequisite is required beyond supplying the crafted register values.

Blast Radius

• Reads arbitrary hypervisor heap contents, exposing in-memory cryptographic material, guest metadata, and other sensitive hypervisor state.
• Overwrites hypervisor heap structures beyond the RealModeMemory buffer, enabling arbitrary control over hypervisor data and potentially redirecting execution flow.
• Crashes the Napoca hypervisor process, taking down all guest VMs sharing that bare-metal host.