← Vulnerability feed

Vulnerability record · CVE-2026-5747 · published 8 April 2026

CVE-2026-5747: Amazon firecracker divide by zero vulnerability

Amazon · Firecracker

An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.

8.7 CVSS 4.0 High EPSS 0.21% · top 90.6% CWE-369 · Divide by zeroCWE-787 · Out-of-bounds write
8.7CVSS 4.0 base score
0.21%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
24 Jul 2026Last modified by NVD

Description

An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.

CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://aws.amazon.com/security/security-bulletins/2026-015-aws/ Vendor Advisory
https://github.com/firecracker-microvm/firecracker/releases/tag/v1.14.4 Release Notes
https://github.com/firecracker-microvm/firecracker/releases/tag/v1.15.1 Release Notes
https://github.com/firecracker-microvm/firecracker/security/advisories/GHSA-776c-mpj7-jm3r Vendor Advisory

Track CVE-2026-5747 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-18960Amazon firecracker classic buffer overflow vulnerabilityFirecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes.EPSS 3.3%7.5CVE-2020-27174Amazon firecracker memory leak vulnerabilityIn Amazon AWS Firecracker before 0.21.3, and 0.22.x before 0.22.1, the serial console buffer can grow its memory usage without limit when data is sen…EPSS 1.7%6.0CVE-2026-1386Amazon firecracker vulnerabilityA UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host us…EPSS 0.22%5.9CVE-2020-16843Amazon firecracker vulnerabilityIn Firecracker 0.20.x before 0.20.1 and 0.21.x before 0.21.2, the network stack can freeze under heavy ingress traffic. This can result in a denial o…EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2026-5747), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.