AWS Vulnerabilities and Affected Products
Vulnerabilities associated with Firecracker.
Products
Clear product- FreeRTOS-Plus-TCP7 vulnerabilities
- tough7 vulnerabilities
- Kiro IDE5 vulnerabilities
- AWS-LC4 vulnerabilities
- Research and Engineering Studio (RES)4 vulnerabilities
- AWS Ops Wheel3 vulnerabilities
- aws-cdk3 vulnerabilities
- Opensearch3 vulnerabilities
- tuftool3 vulnerabilities
- AWS Advanced JDBC Wrapper2 vulnerabilities
- AWS Serverless Application Model Command Line Interface2 vulnerabilities
- AWS-LC-FIPS2 vulnerabilities
- aws-sdk-cpp2 vulnerabilities
- bedrock-agentcore2 vulnerabilities
- Client VPN2 vulnerabilities
- Firecracker2 vulnerabilities
- SageMaker Python SDK2 vulnerabilities
- sagemaker-python-sdk2 vulnerabilities
- strands-agents-tools2 vulnerabilities
- AgentCore CLI1 vulnerability
- Amazon Bedrock AgentCore harness1 vulnerability
- Amazon Braket Python SDK1 vulnerability
- Amazon CloudFront1 vulnerability
- Amazon ECS Agent1 vulnerability
- Amazon Redshift connector for Python1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-5747HIGH | Out-of-bounds Write in Firecracker virtio-pci TransportAn out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. T… | CVSS8.7v4.0 | EPSS0.208% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-1386MEDIUM | Arbitrary Host File Overwrite via Symlink in Firecracker JailerA UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host files via a symlink attack during the initialization copy at jailer startup, if the jailer is executed with root privileges. To mitigate this issue, users should upgrade to version v1.13.2 or 1.14.1 or above. CWE-61Jan 23, 2026 | CVSS6.0v4.0 | EPSS0.195% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |