Home

Description

An out-of-bounds write issue in the virtio PCI transport in Amazon Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.

PUBLISHED Reserved 2026-04-07 | Published 2026-04-07 | Updated 2026-04-08 | Assigner AMZN




HIGH: 7.5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

HIGH: 8.7CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Problem types

CWE-787 Out-of-bounds write

CWE-369 Divide by zero

Product status

Default status
unaffected

1.13.0 (custom)
affected

1.15.0
affected

1.14.4
unaffected

1.15.1
unaffected

References

github.com/...acker-microvm/firecracker/releases/tag/v1.15.1 patch

github.com/...acker-microvm/firecracker/releases/tag/v1.14.4 patch

aws.amazon.com/security/security-bulletins/2026-015-aws/ vendor-advisory

github.com/...racker/security/advisories/GHSA-776c-mpj7-jm3r third-party-advisory

cve.org (CVE-2026-5747)

nvd.nist.gov (CVE-2026-5747)

Download JSON