kmstool-enclave CVE-2026-119116

Exploitation requires (1) the targeted enclave image to include the kmstool-enclave sample application or code derived from it - the aws-nitro-enclaves-sdk-c library by itself is not affected; (2) the attacker to be able to run an application on the parent EC2 instance (PR:L) that can send control messages to the enclave over the vsock channel (AV:L, local to that instance); and (3) a crafted ordered sequence of SetClient and Decrypt messages rather than a single request (AC:H). Exploitation is limited to the affected versions (<= v0.4.5); AWS confirms no cross-instance, cross-account or cross-tenant access is possible, so the impact is contained to the enclave reachable from that parent instance. There are no workarounds - only rebuilding against v0.4.6 remediates the issue.

The vendor-supplied CVSS 4.0 base score is 8.7 (High) with vector AV:L/AC:H/AT:N/PR:L/UI:N and high confidentiality, integrity and availability impact on both the vulnerable system (VC/VI/VA:H) and a subsequent system (SC/SI:H, SA:L). The signals are mixed rather than screaming emergency: the attack vector is local (AV:L) via the vsock channel, attack complexity is high (AC:H, a crafted *sequence* of SetClient and Decrypt messages is needed), and the attacker needs low privileges (PR:L) - specifically the ability to run an application on the parent EC2 instance. There is no CISA KEV listing (status: not confirmed actively exploited), no EPSS score was provided, and no public exploit identified at time of analysis; the issue was found through coordinated disclosure with Trail of Bits. The vuln.today decision label is 'this_week', not act_now/emergency, which is consistent with a serious-but-not-actively-exploited patch-promptly posture. What elevates the real-world importance beyond the raw local vector is the trust model: Nitro Enclaves exist precisely to be protected from a compromised or malicious parent instance, and this flaw lets code on the parent corrupt heap memory inside the enclave and potentially achieve code execution there - breaking exactly the boundary the product is sold to enforce. Against that, the footprint is narrow (only enclave images that bundle kmstool-enclave or code derived from it are affected; the SDK library itself is not), AWS confirms no cross-instance, cross-account or cross-tenant access, and AC:H plus the need for a parent-instance foothold limit opportunistic attacks. Net: a genuine priority for the specific population running kmstool-enclave-based enclaves, but not a broad, wormable internet-facing threat. EPSS and KEV data are absent, so widespread-exploitation probability cannot be quantified from the input.

A malicious or already-compromised application running on the parent EC2 instance sends a crafted sequence of SetClient and Decrypt control messages over vsock to a Nitro Enclave that includes kmstool-enclave. The messages trigger a use-after-free and double-free (CWE-416/CWE-415) that corrupts heap memory inside the enclave, which may lead to arbitrary code execution within the enclave's protected boundary. No public exploit identified at time of analysis; because attack complexity is high (AC:H), the attacker must send a specific ordered sequence rather than a single message.