PT-2026-31052 · Amazon · Amazon Aws Firecracker

Aegiryy + 3 · Published 2026-04-07 · Updated 2026-06-01 · CVE-2026-5747

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amazon Firecracker versions 1.13.0 through 1.14.3 and version 1.15.0

Description A flaw exists in the virtio PCI transport of Amazon Firecracker that could allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host. This is possible through modification of virtio queue configuration registers after device activation. Code execution on the host requires additional conditions, such as a custom guest kernel or specific snapshot configurations.

Recommendations Upgrade to Amazon Firecracker version 1.14.4 or later. Upgrade to Amazon Firecracker version 1.15.1 or later.

Fix

Divide By Zero

Memory Corruption

Weakness Enumeration

CWE-369

CWE-787

Related Identifiers

CVE-2026-5747

OPENSUSE-SU-2026:10561-1

Affected Products

Amazon Aws Firecracker

References · 14

• https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-776c-mpj7-jm3r · Vendor Advisory
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1 · Patch
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10561-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5747 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-015-aws · Vendor Advisory
• https://twitter.com/EnigmaGlobalSW/status/2042580071701946513 · Twitter Post
• https://twitter.com/CVEarity/status/2041764265833705569 · Twitter Post
• https://twitter.com/CveFindCom/status/2041662985437855956 · Twitter Post
• https://t.me/cveNotify/165437 · Telegram Post
• https://suse.com/security/cve/CVE-2026-5747 · Note
• https://twitter.com/eyalestrin/status/2042334290084839677 · Twitter Post
• https://twitter.com/CyberBriefDaily/status/2041785349995950490 · Twitter Post
• https://twitter.com/CVEnew/status/2041711844382187660 · Twitter Post