VulnSocial

CVE-2026-122192

LOWCVSS 7.1 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping. To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-390CWE-825

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 2 mentions (2026-11-04); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-11-04: 2Mentions · 2026-11-05: 211-0411-05
Referenced assets2 URLs
Full discourse4 posts
  • Nicolas Krassas@Dinosn

    Escaping AWS Firecracker from guest userspace: VMM memory corruption (CVE-2026-122192) https://aws.amazon.com/security/security-bulletins/2026-169-aws/

    0401582.4K
    165.6K followersView on X
  • JPMK@_JcryPto_

    Finding the Firecracker bug was only the beginning. With @coinspect, we spent weeks proving a guest could run code in its host-side process, then chained a separate seccomp bypass. The escape is fixed (CVE-2026-122192). Full write-up: https://www.coinspect.com/blog/firecracker-escape/

    240123680
    210 followersView on X
  • ✪ 𝕱𝖆𝖍𝖆𝖉@fad_777

    ثغرة هروب من guest userspace في AWS Firecracker تعني أن حدود العزل بين الـ guest والـ VMM تستحق تدقيقًا أمنيًا دقيقًا. المعلومة المتاحة تشير إلى memory corruption في الـ VMM مرتبطة بالمعرّف CVE-2026-122192، ضمن سياق Firecracker المستخدم لتشغيل microVMs. تتقاطع هذه الحالة مع موضوعات مهمة لمهندسي السحابة والأمن: عزل الـ virtualization، سطح الهجوم داخل البيئات متعددة المستأجرين، وأهمية متابعة ثغرات الـ VMM حتى عندما يبدأ المسار من داخل guest userspace. For cloud security and virtualization teams, a guest-userspace escape involving AWS Firecracker is a serious area to track. The disclosed item points to VMM memory corruption associated with CVE-2026-122192, in the context of Firecracker microVM isolation. Even without additional technical details, the signal is important: VMM vulnerabilities can affect assumptions around workload isolation, sandboxing boundaries, and risk modeling in cloud-native infrastructure. https://aws.amazon.com/security/security-bulletins/2026-169-aws/ #AWS #Firecracker #CVE

    0001050
    97 followersView on X
  • Coinspect Security@coinspect

    AWS advisory: "Firecracker is an open source virtualization technology that powers AWS Lambda and other serverless compute services. We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device. AWS services including AWS Lambda are not affected by this issue. No customer action is required." https://aws.amazon.com/security/security-bulletins/2026-169-aws/

    00010268
    3.2K followersView on X

Explore more

Back to dashboard