# CVE-2026-10046: Bitdefender Napoca out-of-bounds write in BIOS memory map handler

Source: https://junglewise.ai/threats/cve-2026-10046-bitdefender-napoca-out-of-bounds-write-in-bios-memory-map-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-10046 · Severity: info · CVSS 8.5 · Published 2026-06-02

Bitdefender Napoca is a bare-metal hypervisor used to manage and isolate virtual machines. A vulnerability in how it handles memory map requests allows a malicious guest operating system to write data outside of its assigned memory area and into the hypervisor's own memory. This could allow an attacker to compromise the entire host system, though the product is now end-of-life and will not receive a fix.

Vendors: [Bitdefender](https://junglewise.ai/threats/vendors/bitdefender).

## Quick answers

**Is CVE-2026-10046 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10046 being exploited in the wild.

**How severe is CVE-2026-10046?** Informational severity, with a CVSS score of 8.5, published 2 June 2026.

**Which products and versions are affected?** Bitdefender Napoca bare-metal hypervisor.

**Is there a fix for CVE-2026-10046?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10046 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-10046?** Check whether you run Bitdefender Napoca. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability exists in the BIOS INT 0x15 / E820 memory map handler within `napoca/guests/bios_handlers.c`. The root cause is a failure to validate destination offsets computed from guest-controlled ES and EDI register values, which can exceed the 1MB RealModeMemory allocation. By invoking the interrupt with specific register values (AX=0xE820, ES=0xFFFF, EDI=0xFFFF), a malicious guest in real mode can write up to 20 bytes into the hypervisor heap. This vulnerability is classified as CWE-787. No patch is available as the product is end-of-life.

## Affected products

- Bitdefender Napoca bare-metal hypervisor

## Timeline

- 2026-06-02: disclosed
- 2026-06-02: advisory

## References

- [https://www.bitdefender.com/consumer/support/security-advisories/out-of-bounds-write-in-napoca-bios-int-0x15-e820-memory-map-handler-va-13905](https://www.bitdefender.com/consumer/support/security-advisories/out-of-bounds-write-in-napoca-bios-int-0x15-e820-memory-map-handler-va-13905)

## Related threats

- [Bitdefender Napoca out-of-bounds write in real-mode hook handler](https://junglewise.ai/threats/cve-2026-10047-bitdefender-napoca-out-of-bounds-write-in-real-mode-hook-handler)