PT-2026-31052 · Aws · Firecracker

Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-5747

Mitre

CVSS v3.1

7.5

High

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

An out-of-bounds write issue in the virtio PCI transport in Amazon Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86 64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations.

To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.

Fix

Divide By Zero

Memory Corruption

Weakness Enumeration

CWE-369

CWE-787

Related Identifiers

CVE-2026-5747

Affected Products

Firecracker

References · 5

• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4 · Patch
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5747 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-015-aws · Vendor Advisory
• https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-776c-mpj7-jm3r · Note