Vulnerability · 1 source · latest 2h

AWS warns of Firecracker flaw CVE-2026-122192 allowing guest root access to VMM memory

VULNERABILITYCVE-2026-122192redteam/daily · 1 source

Severity: High
Highest CVSS: 7.1
Exploited: Not known
Sources: 1

What happened

CVE-2026-122192 (AWS bulletin 2026-169-AWS, published 11/04/2026) affects Firecracker v0.23.0 through v1.16.1 inclusive. Under certain host memory conditions, a root user in a guest can read or modify memory of the Firecracker process. Exposure is limited to VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device. The articles do not state a fixed version, so defenders should identify Firecracker deployments in this range and check the full AWS bulletin for remediation guidance.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Check whether you run Firecracker between v0.23.0 and v1.16.1 inclusive.
Check whether affected VMs are restored from snapshots using the File memory backend with a balloon or virtio-mem device.
Read the full AWS bulletin 2026-169-AWS for the most up-to-date remediation information.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-122192CVSS 7.1Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins

Who and what is in it

Companies

AWS

Support usRedTeamDaily has no paywall. Readers like you keep security news free for everyone.