We just published our research on escaping Firecracker microVMs, coordinated with AWS.

The interesting part is how a guest can end up accessing memory belonging to the Firecracker process running outside the VM.

The vulnerability: When a microVM is restored from a snapshot using the File memory backend, a failed memory remapping operation can leave KVM referencing a stale host virtual address range. Firecracker may subsequently reuse that memory for its own data, while KVM still considers it guest memory.

This allows a malicious guest to read or overwrite Firecracker VMM process memory, crossing the VM isolation boundary.

Our research demonstrates an exploit chain from guest userspace to controlled code execution in the host.

Affected configurations: Firecracker 0.23.0 - 1.16.1, when restoring snapshots with the File memory backend and a balloon or virtio-mem device.

Fixed: Firecracker 1.16.2 and 1.17.0+.

AWS advisory: https://aws.amazon.com/security/security-bulletins/2026-169-aws/

The write-up covers the vulnerability, the memory-management behavior behind it, and the exploitation process.

We are from Coinspect, the team behind the research. Happy to answer technical questions here.