VulnerabilityAnalyzed

CVE-2026-5747

HIGH 8.7EPSS 0.26%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.26% probability · 17th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-369, CWE-787
Affected: amazon/firecracker
Source: ff89ba41-3aa1-4d27-914a-91399e9639e5

EPSS trend

EPSS 0.3% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

https://aws.amazon.com/security/security-bulletins/2026-015-aws/Vendor Advisory
https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4Release Notes
https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1Release Notes
https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-776c-mpj7-jm3rVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.