PT-2026-45767 · Bitdefender · Napoca

CVE-2026-10047 · Published 2026-06-02 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Bitdefender Napoca (affected versions not specified)

Description An out-of-bounds write exists in the real-mode hook handler within the napoca/kernel/handler.c file. The handler utilizes a guest-controlled offset derived from SS:SP as an index into the 1MB RealModeMemory buffer without performing bounds validation. When SS and ESP are both set to 0xFFFF, the computed offset can reach 0x10FFEF, which exceeds the RealModeMemory buffer by 65,519 bytes. This allows the IRET frame push to write past the buffer end and into the hypervisor heap.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-10047

Affected Products

Napoca

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-10047 · Security Note
• https://bitdefender.com/support/security-advisories/out-of-bounds-write-in-napoca-real-mode-hook-handler-via-guest-controlled-sssp-va-13905 · Vendor Advisory
• https://twitter.com/dailycve/status/2064061699787780146 · Twitter Post