VDB
CVE-2026-5747
CVE-2026-5747
PUBLISHED
CVSS 7.5 HIGH
Reported by AMZN · Published April 7, 2026
An out-of-bounds write issue in the virtio PCI transport in Amazon Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.
EPSS 0.26% · 17.3th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS Score
0.26%
17.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AWS | Firecracker | 1.13.0, 1.15.0, 1.14.4 |
| AWS | Firecracker | 1.13.0, 1.14.4, 1.15.1 |
Timeline
- CVE Published
- Apr 8, 2026 EPSS Score
- Apr 8, 2026 PoC Published
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 20, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 24, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score