CVE-2026-122192: High severity vulnerability

Published Nov 4, 2026

Updated

Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if the host fails to create the replacement mapping.

To remediate this issue, users should upgrade to Firecracker 1.16.2 or 1.17.0 and later.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firecracker to a version that resolves this vulnerability.
Fixed in 1.16.2
Upgrade
Upgrade Firecracker to a version that resolves this vulnerability.
Fixed in 1.17.0

Event History

Nov 4, 2026

CVE Published

via NVD·08:19 PM

Data Sourced

via NVD·08:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

The issue affects Firecracker 0.23.0 through 1.16.1 when a microVM is restored from a snapshot using the File memory backend. Exploitation also involves balloon or virtio-mem discard requests and a host failure to create a replacement memory mapping.

What level of access does an attacker need?

An attacker needs root privileges inside the guest microVM. The attack is local from the guest perspective and does not require user interaction.

Are default Firecracker configurations affected?

The available information identifies a specific snapshot and memory-backend condition rather than stating that default configurations are affected. Exposure depends on restoring a microVM snapshot with the File memory backend and encountering the failed replacement mapping condition.

What should we do to remediate the issue?

Upgrade Firecracker to version 1.16.2, or to version 1.17.0 or later. The provided information does not specify an alternative mitigation for environments that cannot immediately upgrade.

How can we determine whether an environment may be affected?

Identify Firecracker instances running versions 0.23.0 through 1.16.1, then determine whether they restore microVMs from snapshots using the File memory backend. Systems meeting those conditions may be exposed when guest-root users can issue balloon or virtio-mem discard requests and the host fails to create the replacement mapping.

CVE-2026-122192: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What level of access does an attacker need?

Are default Firecracker configurations affected?

What should we do to remediate the issue?

How can we determine whether an environment may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What level of access does an attacker need?

Are default Firecracker configurations affected?

What should we do to remediate the issue?

How can we determine whether an environment may be affected?