The vulnerability appears in the Bitdefender Napoca bare-metal hypervisor. The real-mode hook handler uses a guest-controlled SS:SP pair to calculate an offset into a 1 MB RealModeMemory buffer without bounds validation. When SS=0xFFFF and ESP=0xFFFF the offset reaches 0x10FFEF, 65 519 bytes beyond the buffer, allowing the IRET frame push to write outside the buffer into the hypervisor heap. This can corrupt heap structures and potentially allow exploitation of hypervisor data, leading to privilege escalation or denial of service. The weakness is an out-of-bounds write (CWE-787).

The affected vendor is Bitdefender, product Napoca bare-metal hypervisor. No specific version details are listed; the product is end-of-life and unsupported. Users should stop using this hypervisor.

The CVSS score is 8.5, indicating a high severity design flaw. The EPSS score is not available, so the current probability of exploitation is unknown. The vulnerability is not listed in CISA KEV, implying no known active exploitation. Attackers triggering the flaw must control guest registers SS and SP, so the attack vector is likely local to a guest VM with privileged access. Successful exploitation could corrupt the hypervisor heap, leading to unauthorized code execution on the host or data loss. Overall, the risk is high for any system still running this unsupported hypervisor.