CVE-2026-5747 - Out-of-bounds Write in Firecracker virtio-pci Transport

unknownCVE-2026-5747

Bulletin ID: 2026-015-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/04/07 15:30 PM PDT Description: Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant container and function-based services. We identified CVE-2026-5747, an out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 that might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. No AWS service is affected. Impacted versions: Firecracker >= 1.13.0 AND <= 1.14.3 AND 1.15.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Firecracker product: Firecracker Remote code executionOtheraffected: 1.13.0 - 1.14.3, 1.15.0

What: An out-of-bounds write issue in the virtio PCI transport may allow a local guest user to crash the Firecracker VMM process or execute arbitrary code on the host.
Who is affected: Local guest users with root privileges on Firecracker versions 1.13.0 through 1.14.3 and 1.15.0.
Urgency: Remediation is urgent due to the potential for arbitrary code execution on the host.
Action: Upgrade to a patched version of Firecracker.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Firecracker

Get an email when a new Firecracker advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-20
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-015-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-57470.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 11% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-5747	coverage & exploitation status	NVD · CVE.org

Recent advisories for - Out-of-bounds Write

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-90454: A deployment mode intended to expose only read access to a bundled packet-analysis component's…nvd · 2026-09-11
highCVE-2026-50013: Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is runn…nvd · 2026-09-11
mediumCVE-2026-49439: OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predict…nvd · 2026-09-11
unknownCVE-2026-47773: ArduinoBLE enables Bluetooth Low Energy connectivity on certain Arduino models. Versions prior…nvd · 2026-09-11
unknownCVE-2026-89772: In the Linux kernel, the following vulnerability has been resolved: btrfs: write-protect folio…nvd · 2026-09-11
unknownCVE-2026-89747: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-fre…nvd · 2026-09-11