Threats affecting pkg:github/firecracker-microvm/firecracker

CVE-2026-5747 is an out-of-bounds write vulnerability in the virtio PCI transport component of AWS Firecracker versions 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 architectures. A local guest user with root privileges could exploit this flaw to crash the Firecracker VMM process or potentially execute arbitrary code on the host. Exploitation to achieve code execution requires additional conditions such as a custom guest kernel or specific snapshot configurations. AWS has released fixed versions 1.14.4 and 1.15.1 and later to address this issue.

CVE-2026-1386 is a symbolic link following vulnerability in the jailer component of AWS Firecracker versions 1.13.1 and earlier, and 1.14.0 on Linux. It allows a local user with write access to the jailer directories to overwrite arbitrary host files via a symlink attack during jailer startup if the jailer runs with root privileges. The issue is fixed in Firecracker version 1.13.2 and 1.14.1 or later.