CVE-2026-122192
Received Received - Intake

Memory Corruption in Firecracker via Snapshot Restoration

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: AMZN

Description
Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-122192
EUVD
EUVD-2026-117056

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AWS firecracker 0.23.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-390 The product detects a specific error, but takes no actions to handle the error.
CWE-825 The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1. A guest user with root privileges could read or modify the Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend if the host fails to create a replacement mapping.

Detection Guidance

Detecting this vulnerability requires checking Firecracker versions and snapshot configurations. Verify if your Firecracker version is between 0.23.0 and 1.16.1 using commands like 'firecracker --version'. Check if snapshots use the File memory backend with balloon or virtio-mem devices. Examine host memory settings for failed mappings.

Impact Analysis

A root user in a guest VM could exploit this to read or modify the memory of the Firecracker process, potentially leading to unauthorized access, data leaks, or system compromise. This is especially risky for multi-tenant environments where isolation is critical.

Mitigation Strategies

Upgrade Firecracker to version 1.16.2 or 1.17.0 or later immediately. If upgrading is not possible, avoid using the File memory backend with balloon or virtio-mem devices. Restore snapshots using the Uffd memory backend as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...