What’s Vulnerable › Vulnerabilities

CVE-2026-5747: Out-of-bounds Write in Firecracker virtio-pci Transport

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-08 · updated 2026-07-24
• Weakness: CWE-369

Description

An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.

Affected products

• AWS Firecracker: from 1.13.0 through 1.14.3; 1.15.0, 1.15.0-dev

References

• https://aws.amazon.com/security/security-bulletins/2026-015-aws/
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4
• https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1
• https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-776c-mpj7-jm3r

Get alerted when CVE-2026-5747 or the next vulnerability affects your stack