Is there a patch available for CVE-2026-19643?

Yes, a patch is available for CVE-2026-19643. Update the affected software to the latest version immediately.

aws-sdk-cpp CVE-2026-19643

Q: What is the CVSS score of CVE-2026-19643?

CVE-2026-19643 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-57524 MEDIUM

Out-of-bounds Read (CWE-125)

2026-08-12 AMZN

Buffer Overflow Information Disclosure AWS Aws Sdk Cpp

6.0

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable decoder crash triggered by authenticated low-privilege input; high complexity for platform-specific triggering; availability-only impact with no confidentiality or integrity effects.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:53 vuln.today

CVSS changed

Aug 12, 2026 - 20:22 NVD

5.3 (MEDIUM) 6.0 (MEDIUM)

DescriptionCVE.org

An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input.

To remediate this issue, users should upgrade to version 1.11.862.

AnalysisAI

Remote authenticated users can crash applications built on Amazon aws-sdk-cpp versions before 1.11.862 by supplying crafted Base64-encoded input that triggers an out-of-bounds read in the SDK's Base64 decoder. Exploitation is constrained to authenticated users, requires high attack complexity, and is platform-specific - not all deployments are vulnerable. The CVSS 4.0 vector (VA:H, VC:N, VI:N) confirms impact is limited to availability (denial of service); no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

The vulnerability is a CWE-125 (Out-of-Bounds Read) defect in the Base64 decoding routine of the Amazon AWS SDK for C++ (aws-sdk-cpp), the official C++ library for AWS service integration (CPE: cpe:2.3:a:aws:aws-sdk-cpp:*:*:*:*:*:*:*:*). Out-of-bounds reads in Base64 decoders typically arise from missing or incorrect bounds checks when processing padded, malformed, or non-standard input sequences, causing the decoder to read past the allocated buffer. The 'on some platforms' qualifier indicates the bug's manifestation is architecture- or compiler-dependent, likely stemming from platform differences in integer widths, memory alignment, or how undefined behavior is resolved by the underlying toolchain. Applications that accept externally-supplied Base64 data and pass it through the SDK decoder without prior sanitization represent the core attack surface.

RemediationAI

Upgrade aws-sdk-cpp to version 1.11.862 or later, which resolves the out-of-bounds read in the Base64 decoder; the release is available at https://github.com/aws/aws-sdk-cpp/releases/tag/1.11.862 with vendor details at https://aws.amazon.com/security/security-bulletins/2026-080-aws/. As a compensating control prior to patching, applications can validate and reject malformed or non-canonical Base64-encoded input before passing it to the SDK decoder - for example, enforcing strict character set and padding rules at the application boundary - which reduces exposure without requiring an immediate SDK upgrade. Note that application-layer input validation introduces additional processing overhead and does not eliminate the underlying library defect; it should be treated as a temporary measure only.