AWS Nitro Enclaves SDK for C CVE-2026-119148

Exploitation requires an application running on the parent EC2 instance (local, AV:L) that passes an externally supplied, unvalidated AWS Region string to the aws-nitro-enclaves-sdk-c library at or before v0.4.5; the attacker must be able to supply a crafted long region value that truncates the KMS domain suffix used to build the KMS TLS server name. Only enclave applications that forward an unvalidated, externally-controlled region to the library are affected - applications that hardcode or validate the region are not. Limiting factors: the attacker needs a foothold/privilege on the parent instance (PR:L), there is no remote network vector, no cross-account or cross-tenant access is possible, and authentic KMS responses remain separately encrypted so confidentiality is not impacted.

This is a moderate, locally-scoped integrity vulnerability rather than a mass-exploitation emergency. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the attack is LOCAL, requires some privilege (PR:L), and needs no user interaction; the impact is limited to integrity (VI:H/SI:H) with no confidentiality (VC:N) or availability (VA:N) impact, consistent with the GHSA description that authentic KMS responses remain separately encrypted and not at risk. No EPSS score, no CISA KEV listing, and no public exploit reference are present in the input, so there is no signal of widespread or active exploitation; it was found via coordinated disclosure with Trail of Bits and reported by AMZN. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious-but-not-critical, patch-promptly posture. The CWE-807 classification (reliance on untrusted inputs in a security decision) matches the mechanism: an attacker-influenced region string undermines the enclave's KMS endpoint trust decision. Net: a real priority for anyone running Nitro Enclave applications that pass externally supplied region values, but the local vector, privilege requirement, and absence of exploitation signals keep it below drop-everything urgency.

An application running on the parent EC2 instance passes an attacker-influenced, crafted oversized AWS Region string into the enclave SDK; the library builds the KMS TLS server name from it without validation, truncating the KMS domain suffix. The Nitro Enclave then misjudges the authenticity of the KMS TLS certificate, letting a party positioned as the KMS endpoint impersonate KMS and inject forged responses into the enclave's KMS requests. No public exploit code is identified in the available data; the trigger details come from the vendor GHSA advisory.