Vulnerability · 1 source · latest 2h

AWS warns of Firecracker flaw CVE-2026-122192 allowing guest root access to VMM memory

VULNERABILITYCVE-2026-122192redteam/daily · 1 source

Severity: High
Highest CVSS: 7.1
Exploited: Not known
Sources: 1

What happened

Amazon Web Services (AWS) has published a warning about a security flaw in Firecracker, the software used to run virtual machines. Under certain memory conditions, a user with administrator rights inside a virtual machine could read or change memory belonging to the Firecracker process itself.

Like I’m new · Written by AI from 1 source · Wrong?

What to do

Check whether you run Firecracker between v0.23.0 and v1.16.1 inclusive.
Check whether affected VMs are restored from snapshots using the File memory backend with a balloon or virtio-mem device.
Read the full AWS bulletin 2026-169-AWS for the most up-to-date remediation information.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-122192CVSS 7.1Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the

Full story timeline · 2 updates

Who reported · 1 outlet

AWS Security Bulletins

Who and what is in it

Companies

AWS

Support usRedTeamDaily has no paywall. Readers like you keep security news free for everyone.