Skip to content
AWS Firecracker Vulnerability CVE-2026-122192 Exposes Memory to Guest Users

AWS Firecracker Vulnerability CVE-2026-122192 Exposes Memory to Guest Users

First seen 5 Nov 2026, 03:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 5, 2026 at 03:50 UTC
  • •CVE-2026-122192 allows guest users to access Firecracker process memory.
  • •Affected versions include Firecracker 0.23.0 to 1.16.1; patches are available in 1.16.2 and 1.17.0.
  • •AWS services like Lambda are not impacted by this vulnerability.

CVE-2026-122192 affects Firecracker versions 0.23.0 to 1.16.1, allowing root users in a guest VM to read or modify the Firecracker process memory under certain conditions. This vulnerability arises when a microVM is restored from a snapshot using the File memory backend, leading to a failure in memory remapping. The issue does not affect AWS services like AWS Lambda. AWS has released patches in versions 1.16.2 and 1.17.0 to mitigate this vulnerability. Operators are advised to upgrade or use alternative memory backends if immediate upgrades are not feasible. The vulnerability was disclosed on November 4, 2026, with a CVSS score of 7.5, indicating a high severity level. The research was conducted by Coinspect, who coordinated with AWS on the disclosure.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 4h ago How this analysis works

Timeline

2026-11-04
CVE-2026-122192 published
AWS disclosed the vulnerability allowing guest access to Firecracker process memory after a failed memory discard.
Aws.Amazon
2026-11-04
Research published by Coinspect
Coinspect published findings on exploiting Firecracker microVMs, detailing the memory corruption issue.
Reddit

More articles in this cluster (5)

Following this threat?

Track AWS and CVE-2026-122192 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

Which versions of Firecracker are affected?
Firecracker versions 0.23.0 through 1.16.1 are affected by CVE-2026-122192.
What should I do if I can't upgrade immediately?
If immediate upgrades are not possible, consider using the Uffd memory backend for restoring snapshots.
Is there a risk of exploitation in the wild?
Currently, there are no reports of active exploitation for this vulnerability.