CVE-2026-10046

Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocation. A malicious guest operating in real mode can trigger the issue by invoking INT 0x15 with AX=0xE820, EDX=0x534D4150, ECX greater than or equal to 20, EBX=0, ES=0xFFFF, and EDI=0xFFFF. This can cause a write of up to 20 bytes past the end of the RealModeMemory buffer into the hypervisor heap. The product is end-of-life and unsupported when assigned.

• CWE-787

• https://www.bitdefender.com/consumer/support/security-advisories/out-of-bounds-write-in-napoca-bios-int-0x15-e820-memory-map-handler-va-13905Broken Link

Published

Jun 2, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100418Flame through 2.4.0 contains an information exposure vulnera…5.3
• CVE-2026-100419gitoxide gix-fs before 0.23.0 contains a path validation byp…7
• CVE-2026-10042manga-image-translator contains a remote code execution vuln…9.8
• CVE-2026-10043MosaicML Composer Deserialization of Untrusted Data Remote C…7.8
• CVE-2026-10044Usagi-org ai-goofish-monitor contains an unauthenticated arb…8.2
• CVE-2026-10045Shenzhen Kangda Xin Intelligent Network Technology Company's…9.8
• CVE-2026-10047The Bitdefender Napoca bare-metal hypervisor contains an out…7.8
• CVE-2026-1005Integer underflow in wolfSSL packet sniffer <= 5.8.4 allows …5.3
• CVE-2026-10050In Eclipse Jetty, the Digest authentication server-side comp…9.1
• CVE-2026-100501Flame through 2.4.0 contains an improper restriction of exce…6.5
• CVE-2026-100502Flame through 2.4.0 contains an insufficient session expirat…5
• CVE-2026-100503Ghidra versions through 12.1.4 contain a heap use-after-free…3.3