CVE-2026-5747
An out-of-bounds write issue in the virtio PCI transport in Amazon Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 0.21%
- CWE
- CWE-787, CWE-369
- Published
- 2026-04-07
- Last modified
- 2026-04-20
Affected products
- AWS Firecracker
- AWS Firecracker
- AWS Firecracker
- AWS Firecracker
Weakness type
Related vulnerabilities
- CVE-2026-0310 — PAN-OS: Buffer Overflow Vulnerability via XML Processing
- CVE-2026-56711 — VLC media player 3.0.0 through 3.0.23 Heap Out-of-Bounds Write via Integer Overflow in Picture Allocation
- CVE-2026-87638 — Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87491 — Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87621 — Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote...
- CVE-2026-87438 — Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote...
- CVE-2026-53938 — OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW)
- CVE-2026-81980 — Acrobat Reader | Out-of-bounds Write (CWE-787)