Buffer overflow in Amazon Firecracker
CVE-2026-5747
An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.
EPSS: 0.002 (11.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Amazon Firecracker — versions 1.15.0
- Aws Firecracker — versions 1.13.0, 1.15.0, 1.14.4
Weakness classification (CWE)
References
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (Release Notes, patch)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (Release Notes, patch)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory, Vendor Advisory)
- ff89ba41-3aa1-4d27-914a-91399e9639e5 (Vendor Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-5747?
- CVE-2026-5747 is a high-severity vulnerability in Amazon Firecracker, classified under Divide By Zero. CVSS score: 7.5/10. Published 2026-04-08.
- How severe is CVE-2026-5747?
- High severity. CVSS v3 base score is 7.5 out of 10.