What is 2026-169-AWS?

2026-169-AWS is a security advisory published by AWS Security Bulletins. CVE-2026-122192 - Guest Access to Firecracker Process Memory After a Failed Memory Discard

Which CVE IDs does 2026-169-AWS cover?

2026-169-AWS covers the following CVE IDs: CVE-2026-122192. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

2026-169-AWS

CVE-2026-122192 - Guest Access to Firecracker Process Memory After a Failed Memory Discard

Vendor

AWS Security Bulletins

Published

November 4, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-122192 →

📋 Description

Bulletin ID: 2026-169-AWS Publication Date: 11/04/2026 11:30 AM PST Description: We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through v1.16.1 that, under certain host memory conditions, can let a root user in a guest read or modify memory of the Firecracker process. It affects VMs restored from a snapshot using the File memory backend with a balloon or virtio-mem device. Impacted versions: Firecracker v0.23.0 through v1.16.1, inclusive. Refer to the article below for the most up-to-date and complete information. Read this article

🔗 References (1)

advisoryhttps://aws.amazon.com/security/security-bulletins/rss/2026-169-aws/