Amazon AWS Firecracker up to 1.14.3/1.15.0 on x86-64 Virtio PCI Transport out-of-bounds write

Summaryinfo

A vulnerability classified as critical was found in Amazon AWS Firecracker up to 1.14.3/1.15.0 on x86-64. Affected is an unknown function of the component Virtio PCI Transport. The manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2026-5747. The attack requires a local approach. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Amazon AWS Firecracker up to 1.14.3/1.15.0 on x86-64. It has been classified as critical. Affected is an unknown function of the component Virtio PCI Transport. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An out-of-bounds write issue in the virtio PCI transport in Amazon Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-5747 since 04/07/2026. The exploitability is told to be difficult. The attack needs to be approached locally. Additional levels of successful authentication are required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.14.4 or 1.15.1 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202604-1899). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Amazon

Name

• AWS Firecracker

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.14.0
• 1.14.1
• 1.14.2
• 1.14.3
• 1.15.0

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion