CVE-2026-122192: Firecracker VMM Memory Compromise

CVE-2026-122192 affects Firecracker, the AWS hypervisor VMM (virtual machine monitor) used in cloud, serverless, and containerized environments. The flaw lies in improper handling of failed memory remap operations in versions 0.23.0 through 1.16.1. An attacker with root privileges inside a guest can exploit balloon or virtio-mem discard requests to read and modify the VMM host process memory when a microVM is restored from a snapshot with the File memory backend.

The vulnerability carries a CVSS score of 7.5 (high), confirmed in the official NVD record. The flaw has been remediated in versions 1.16.2 and 1.17.0 and later. Active discussion signals emerge on social media (4 posts in the last 24 hours with 8 interactions): security researchers explicitly flag the risk of guest root compromising VMM memory, underscoring the importance of timely patching.

Recommended actions are immediate: verify which Firecracker version runs in your cloud and containerized environments; deploy upgrades to 1.16.2 or 1.17.0+ across affected systems. For organizations unable to upgrade immediately, assess whether microVMs are restored from snapshots with File memory backend and whether workloads require guest root access, as all these specific conditions must be present for exploitation.