PT-2026-31052 · Amazon · Amazon Aws Firecracker

Aegiryy + 3 · CVE-2026-5747 · Published 2026-04-07 · Updated 2026-06-11

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Firecracker versions 1.13.0 through 1.14.3 Firecracker version 1.15.0

Description An out-of-bounds write issue exists in the virtio PCI transport on x86 64 and aarch64 architectures. A local guest user with root privileges can exploit this by modifying virtio queue configuration registers after device activation to crash the Firecracker VMM process or potentially execute arbitrary code on the host. Host code execution requires additional preconditions, such as specific snapshot configurations or the use of a custom guest kernel.

Recommendations For versions 1.13.0 through 1.14.3, upgrade to version 1.14.4 or later. For version 1.15.0, upgrade to version 1.15.1 or later.

Exploit

Fix

Memory Corruption

Divide By Zero

Weakness Enumeration

CWE-787

CWE-369

Related Identifiers

CVE-2026-5747

GHSA-776C-MPJ7-JM3R

OPENSUSE-SU-2026:10561-1

Affected Products

Amazon Aws Firecracker

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5747.json · Exploit
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4 · Patch
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1 · Patch
• https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-776c-mpj7-jm3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5747 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-015-aws · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-5747 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10561-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-5747 · Note
• https://twitter.com/CveFindCom/status/2041662985437855956 · Twitter Post
• https://twitter.com/EnigmaGlobalSW/status/2042580071701946513 · Twitter Post
• https://twitter.com/CVEnew/status/2041711844382187660 · Twitter Post
• https://t.me/cveNotify/165437 · Telegram Post
• https://twitter.com/CVEarity/status/2041764265833705569 · Twitter Post
• https://twitter.com/terrynini38514/status/2065090742415139122 · Twitter Post