7.5 High

CVE-2026-122192 Guest access to Firecracker process memory after a failed memory discard

Description

Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitable with local access to the machine, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Local
Attack complexity: High
Privileges required: High
Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
Firecracker 0.23	0.23.0 → < 1.16.2	1.16.2

References

github.com github.com
github.com github.com
aws.amazon.com aws.amazon.com
github.com github.com

Timeline

Published November 4, 2026
Last modified November 4, 2026

The 3 CVEs of Firecracker →

CVE-2026-5747 An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and… 7.5 High CVE-2026-1386 A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on… 6.0 Medium

Track this CVE