Raw vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-5747 is a high-severity Divide By Zero (CWE-369) vulnerability in Amazon Firecracker. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-5747 is an out-of-bounds write vulnerability in the virtio PCI transport component of Firecracker microVM, affecting versions 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 architectures. The issue stems from improper handling that allows modification of virtio queue configuration registers after device activation, classified under CWE-369 (Divide by Zero) and CWE-787 (Out-of-bounds Write), with a CVSS v3.1 base score of 7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
A local attacker with root privileges inside a guest VM can exploit this vulnerability to crash the Firecracker VMM process or, under additional preconditions such as a custom guest kernel or specific snapshot configurations, potentially achieve arbitrary code execution on the host system.
Official advisories, including the AWS security bulletin and Firecracker GitHub security advisory (GHSA-776c-mpj7-jm3r), recommend upgrading to Firecracker 1.14.4 or 1.15.1 and later versions, with release notes available on GitHub detailing the fixes.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19996
Vulnerability Data
An out-of-bounds write issue in the virtio PCI transport in Firecracker 1.13.0 through 1.14.3 and 1.15.0 on x86_64 and aarch64 might allow a local guest user with root privileges to crash the Firecracker VMM process or potentially execute arbitrary code…
more
on the host via modification of virtio queue configuration registers after device activation. Achieving code execution on the host requires additional preconditions, such as the use of a custom guest kernel or specific snapshot configurations. To remediate this, users should upgrade to Firecracker 1.14.4 or 1.15.1 and later.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including static/dynamic analysis) finds divide-by-zero conditions after they have been coded.
Requiring documented secure-development standards and tools can mandate bounds-checked coding practices that avoid the weakness.
Security engineering principles can require safe-arithmetic constructs or explicit guards that keep division operands nonzero.
Validating numeric inputs before use as divisors structurally blocks zero values from reaching division operations.
Memory-protection mechanisms limit the exploitability and blast radius of a successful out-of-bounds write.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include code analysis, input validation, and testing that prevent divide-by-zero errors.
Vulnerability identification processes can discover divide-by-zero flaws via static analysis or testing.
Routine patching and replacement can remediate divide-by-zero bugs present in deployed software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect divide-by-zero conditions before release.
Secure development lifecycle includes input validation and error-handling practices that can prevent divide-by-zero faults.
Application security requirements can mandate checks for zero denominators and safe arithmetic handling.
Secure architecture principles encourage defensive coding patterns that avoid arithmetic exceptions.
Secure coding standards directly require validation to prevent divide-by-zero and similar runtime faults.
Change management can enforce review gates that catch unsafe memory operations before deployment.