Advisoriesby IbisAWSAWS-2026-169
Guest Access to Firecracker Process Memory After a Failed Memory Discard
No fix yet
Bulletin ID: 2026-169-AWS Publication Date: 11/04/2026 11:30 AM PST Description: We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device. Impacted versions: Firecracker v0.23.0 through v1.16.1, inclusive. Refer to the article below for the most up-to-date and complete information. Read this article
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Changes since it was listed
Severity: Unrated to High
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- Severity from
- NVD
More AWS advisories
All AWS
GluonTS arbitrary file write during archive extractionCVE-2026-119083no fix yetImproper isolation of shared resources in aws-network-policy-agent in Amazon EKSCVE-2026-122266no fix yetAWS API MCP Server OAuth token audience validation bypassCVE-2026-115413no fix yetRemote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection...CVE-2026-119084no fix yetStored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup renderingCVE-2026-121652no fix yetBabelfish for PostgreSQL Privilege EscalationCVE-2026-119922no fix yet