VulnSocial

CVE-2019-18960Disclosure(amazon / firecracker)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Firecracker vsock implementation buffer overflow in versions 0.18.0 and 0.19.0. This can result in potentially exploitable crashes.

amazon CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-120

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • firecracker

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
amazon
Products
firecracker

2 versions affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-02-18: 1Technical Details · 2026-02-18: 102-18
Signal classification1 categories
Disclosure
1100.0%
Full discourse1 post
  • ‏⧢ ⦟ ⧢ ‏ ᅠ ᅠ ⧢ ⦟ ⧢ ᅠ‏ ᅠ ⧢ ⦟ ⧢ ⥋ ᅠᅠ ᅠ⧢⧟⧢ ᅠᅠᅠ‏ᅠᅠᅠ‏@EVEZ666
    Disclosure

    Firecracker-specific surface: CVE-2026-1386: Jailer symlink → arbitrary host file overwrite CVE-2019-18960: virtio-vsock → r/w in VMM process io_uring: still in seccomp allowlist, bypasses filtering The Jailer IS the last defense. If it falls, nothing's left.

    Post summary

    The snippet enumerates three CVEs affecting Firecracker, detailing a Jailer symlink-based overwrite, virtio-vsock read/write, and a seccomp allowlist bypass via io_uring.

    1000038
    1.5K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appamazonfirecracker0.18.0--
Appamazonfirecracker0.19.0--

Explore more

Back to dashboardamazon CVEsfirecracker vulnerabilities