awsdac CVE-2026-81838

The victim must actively process a malicious diagram bundle (zip file) using awsdac versions 0.10 through 0.23 - confirmed by the UI:A metric in the provided CVSS 4.0 vector. The attacker requires no authentication or privileges on the victim's system (PR:N) but must deliver the bundle through a social-engineering channel such as a shared diagram repository, email, or download link. The attack vector is local (AV:L), meaning exploitation occurs on the victim's own machine when they invoke awsdac against the crafted file. Exploitation is strictly limited by the requirement for deliberate user interaction; automated or unsolicited remote compromise of unpatched systems is not possible - a victim must choose to process the malicious bundle.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H) scores 6.8, reflecting a local attack requiring user interaction with high integrity and availability impact but no confidentiality exposure. Real-world risk is meaningfully constrained by the delivery mechanism: the attacker must convince a user to process a malicious diagram bundle, which limits opportunistic or mass exploitation and positions this squarely as a targeted social-engineering threat. No EPSS score is included in the available data, so exploitation probability cannot be quantified; the absence of a CISA KEV listing and any known public exploit code further supports a moderate rather than urgent prioritization for most organizations. Teams that routinely consume externally authored or community-shared diagram bundles face elevated exposure compared to those processing only internally controlled diagrams. The CVSS integrity and availability signals are consistent with the description - arbitrary file writes can overwrite scripts or configs, enabling persistence - so no conflict between the vector and the narrative is apparent.

An attacker crafts a malicious diagram bundle zip file containing entries with path traversal sequences such as '../../cron.d/backdoor' or '../../.ssh/authorized_keys'. The bundle is distributed via a public diagram-sharing repository, email attachment, or community forum targeting awsdac users. When a victim processes the bundle with an affected awsdac version, files are silently written outside the intended extraction directory, potentially enabling persistence or privilege escalation without any visible error.