{
  "id": 18709318,
  "title": "Firecracker VM Escape: PwnEscape Part 2",
  "url": "https://urgent.news/2026/11/07/firecracker-vm-escape-pwnescape-part-2",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T08:44:02.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://pwn.ai/blog/firecracker-escape"
  },
  "original_language": "en",
  "account": "Firecracker is a tool designed to keep untrusted code contained within microVMs. However, the researchers discovered a way to escape this confinement and execute code as root on the host machine. They analyzed how Firecracker saved registers, altered the return point, and executed a function of their choice upon returning from KVM. Once inside the host, the VM remained accessible via SSH.\n\nThe researchers first created a mapping in the guest memory, introducing a unique byte pattern, or nonce, to locate Firecracker in the host memory. They then searched for the EPT root, which serves as the starting point for address translation between the guest and host physical address spaces. This search yielded two potential EPT roots, but further validation reduced it to a single EPT root. Using this root, they identified the host page table root (PGD) that mapped the guest page.\n\nNext, they located the Firecracker executable within the mapped process using the identified PGD and a unique byte sequence found within the Firecracker write(2) wrapper. This discovery allowed them to determine the load bias of the Firecracker image, which enabled them to pinpoint the specific code required for the exploit. With the necessary information, the researchers were able to locate and modify the saved register frame of the active vCPU thread within the Firecracker process.\n\nBy analyzing the return address within the modified frame, they could execute arbitrary code within the Firecracker process. This breakthrough enabled them to demonstrate CVE-2026-99999 on a Firecracker setup, successfully executing code as root on the host machine.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}