Vulnerability · Published Apr 7, 2026 · Assigned by AMZN
CVE-2026-5747Out-of-bounds Write in Firecracker virtio-pci Transport
High 7.5
In plain English
A high-severity out-of-bounds write in Firecracker from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Official description
An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AWS | Firecracker | 1.13.0 – through 1.14.31.15.0 |
Weakness: CWE-787, CWE-369 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1 patch
- https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4 patch
- https://aws.amazon.com/security/security-bulletins/2026-015-aws/ vendor-advisory
- https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-776c-mpj7-jm3r third-party-advisory