← Retour aux CVEs

CVE-2026-5747

HIGH

7.5

Description

An out-of-bounds write issue in the virtio PCI transport in Amazon Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.

Details CVE

Score CVSS v3.17.5

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Vecteur d'attaqueLOCAL

ComplexiteHIGH

Privileges requisHIGH

Interaction utilisateurNONE

Publie4/8/2026

Derniere modification4/8/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-369CWE-787

References

https://aws.amazon.com/security/security-bulletins/2026-015-aws/(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1(ff89ba41-3aa1-4d27-914a-91399e9639e5)

https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-776c-mpj7-jm3r(ff89ba41-3aa1-4d27-914a-91399e9639e5)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.