CVE-2026-10047

Executive Summary

CVE-2026-10047 is a critical out-of-bounds write vulnerability in the Bitdefender Napoca bare-metal hypervisor, specifically within the real-mode hook handler (napoca/kernel/handler.c). The vulnerability arises because the handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without performing bounds validation. By setting SS=0xFFFF and ESP=0xFFFF, an attacker can compute an offset of 0x10FFEF, which exceeds the buffer by 65,519 bytes. This allows the IRET frame push to write past the end of the buffer into the hypervisor heap, potentially leading to arbitrary code execution within the hypervisor context. The product is end-of-life and unsupported, meaning no official patch will be released.

Supply Chain & Package Security

This vulnerability is not related to any package ecosystem (NPM, PyPI, Go, Ruby). It affects a proprietary bare-metal hypervisor product from Bitdefender.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, but based on the technical details, the vulnerability is severe. The lack of bounds checking on a guest-controlled offset allows an attacker to write controlled data (the IRET frame) into the hypervisor heap. This can lead to arbitrary code execution, compromising the entire hypervisor and all guest virtual machines. The attack vector is local (requires access to a guest VM), but the impact is high (confidentiality, integrity, and availability of the hypervisor and all guests). The product is end-of-life, so no patch is available.

Deep Dive & Mechanics

The vulnerability is in the real-mode hook handler of the Bitdefender Napoca hypervisor. The handler is designed to intercept real-mode operations from guest virtual machines. It uses a buffer called RealModeMemory (1MB in size) to store data related to these operations.

The critical flaw is in how the handler calculates an offset into this buffer. It uses the guest-controlled SS (Stack Segment) and ESP (Extended Stack Pointer) registers to compute the offset:

• Offset = (SS << 4) + ESP

With SS=0xFFFF and ESP=0xFFFF, the computed offset is:

• Offset = (0xFFFF << 4) + 0xFFFF = 0xFFFF0 + 0xFFFF = 0x10FFEF

The RealModeMemory buffer is only 1MB (0x100000 bytes). The computed offset of 0x10FFEF exceeds the buffer by 65,519 bytes (0x10FFEF - 0x100000 = 0xFFEF = 65,519). The handler then writes an IRET frame (a data structure used for interrupt return) at this out-of-bounds offset, corrupting the hypervisor heap.

This is a classic out-of-bounds write vulnerability (CWE-787). The attacker controls the write location and the data written (the IRET frame), which can be crafted to achieve arbitrary code execution.

Vulnerable vs. Patched Code

Since the product is end-of-life and unsupported, there is no patched code. The vulnerable code is in napoca/kernel/handler.c. The fix would involve adding bounds checking before using the computed offset to write to the RealModeMemory buffer.

Vulnerable Code (Conceptual):

// napoca/kernel/handler.c
void real_mode_hook_handler() {
    uint16_t ss = get_guest_ss();
    uint32_t esp = get_guest_esp();
    uint32_t offset = (ss << 4) + esp;
    // No bounds check on offset
    write_iret_frame(&RealModeMemory[offset]);
}

Patched Code (Conceptual):

// napoca/kernel/handler.c
void real_mode_hook_handler() {
    uint16_t ss = get_guest_ss();
    uint32_t esp = get_guest_esp();
    uint32_t offset = (ss << 4) + esp;
    if (offset + sizeof(iret_frame) > REAL_MODE_MEMORY_SIZE) {
        // Handle error, reject the operation
        return;
    }
    write_iret_frame(&RealModeMemory[offset]);
}

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker needs to be able to execute code within a guest virtual machine running on the Bitdefender Napoca hypervisor. The attacker must set the SS and ESP registers to specific values (e.g., SS=0xFFFF, ESP=0xFFFF) to trigger the out-of-bounds write. The IRET frame written to the hypervisor heap can be crafted to overwrite critical data structures, such as function pointers or return addresses, to achieve arbitrary code execution.

Exploit Steps:

1. Gain code execution within a guest VM.
2. Set SS=0xFFFF and ESP=0xFFFF.
3. Trigger a real-mode operation that invokes the vulnerable hook handler.
4. The handler writes an IRET frame at the out-of-bounds offset, corrupting the hypervisor heap.
5. The crafted IRET frame overwrites a function pointer or return address in the hypervisor heap.
6. When the hypervisor executes the corrupted function pointer, control is transferred to attacker-controlled code.

Example Assembly (Guest VM):

; Set SS and ESP to trigger the vulnerability
mov ax, 0xFFFF
mov ss, ax
mov esp, 0xFFFF
; Trigger a real-mode interrupt to invoke the vulnerable handler
int 0x?? ; Replace with appropriate interrupt number

Blue Team

Detection of this vulnerability is challenging because it requires monitoring hypervisor-level memory accesses. However, the following indicators can be used:

• Monitor for unusual SS and ESP values in guest VM state (e.g., SS=0xFFFF, ESP=0xFFFF).
• Monitor for out-of-bounds memory accesses in the hypervisor's RealModeMemory buffer.
• Monitor for unexpected crashes or heap corruption in the hypervisor.

Indicators of Compromise (IOCs)

• Memory Corruption: Hypervisor heap corruption at offsets beyond the RealModeMemory buffer.
• Guest State: Guest VM with SS=0xFFFF and ESP=0xFFFF.
• Hypervisor Crash: Unexpected crashes or hangs in the hypervisor due to corrupted heap.
• Logs: Hypervisor logs showing out-of-bounds memory access attempts.

Detection Engineering

YARA Rule

rule CVE_2026_10047_RealModeHookOOB {
    meta:
        description = "Detects the out-of-bounds write in Bitdefender Napoca hypervisor real-mode hook handler"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-10047"
    strings:
        $code1 = { 8E D0 8B E0 } // mov ss, ax; mov esp, eax (example)
        $code2 = { CD ?? } // int 0x?? (trigger interrupt)
    condition:
        $code1 and $code2
}

Sigma Rule

title: CVE-2026-10047 - Bitdefender Napoca Hypervisor Out-of-Bounds Write
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit the out-of-bounds write vulnerability in Bitdefender Napoca hypervisor real-mode hook handler.
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10047
logsource:
    product: hypervisor
    service: napoca
detection:
    selection:
        EventID: 1001
        SS: 0xFFFF
        ESP: 0xFFFF
    condition: selection
falsepositives:
    - Unknown
level: critical

Suricata Rule

alert ip any any -> any any (msg:"CVE-2026-10047 - Bitdefender Napoca Hypervisor Out-of-Bounds Write Attempt"; content:"|8E D0 8B E0|"; content:"|CD|"; distance:0; within:2; sid:1000001; rev:1;)

Remediation & Mitigation

Since the product is end-of-life and unsupported, no official patch is available. The following mitigations are recommended:

1. Upgrade: Migrate to a supported hypervisor solution immediately.
2. Isolation: If migration is not possible, isolate the affected hypervisor from untrusted guest VMs.
3. Monitoring: Implement monitoring for the IOCs listed above to detect exploitation attempts.
4. Access Control: Restrict access to the hypervisor management interface to trusted administrators only.
5. Virtual Patching: If using a virtual patching solution (e.g., WAF, IDS/IPS), create custom rules to block exploitation attempts based on the SS and ESP values.

Valters IT