S3 Encryption Client EUVD-2026-101618

Exploitation requires an application using the Amazon.Extensions.S3.Encryption (.NET) client with RSA envelope-key wrapping, where the attacker has authenticated access to both read encrypted objects AND modify those objects' metadata in the S3 bucket (reflected in PR:L). The attacker must force a padding downgrade by rewriting the object metadata's recorded padding scheme to legacy PKCS#1 v1.5, then mount an adaptive Bleichenbacher padding-oracle attack requiring many decryption queries (reflected in AT:P). LIMITING FACTORS: this is not remotely exploitable by an anonymous attacker - valid credentials with object read/write-metadata permissions are prerequisite; the oracle attack is non-automatable (per SSVC) and query-intensive; and only RSA-wrapped objects are affected, so deployments using AES/KMS key wrapping or already on versions 3.2.2/4.0.3 are not exposed.

This is a genuine but moderate-priority cryptographic vulnerability, not a drop-everything emergency. The CVSS 4.0 score of 6.0 (MEDIUM) is well-calibrated: the vector AV:N/AC:L/AT:P/PR:L/UI:N shows network reachability but requires authenticated access (PR:L - a user who can already read encrypted objects and alter their metadata) plus a specific attack requirement (AT:P), reflecting that a Bleichenbacher padding oracle attack needs many adaptive queries rather than a single shot. Impact is confidentiality-only (VC:H, VI:N, VA:N) - key recovery leads to object decryption but no integrity or availability loss. All exploitation signals point low: SSVC rates Exploitation 'none', Automatable 'no', and Technical Impact only 'partial'; there is no CISA KEV listing and no public exploit identified at time of analysis; no EPSS score was provided in the input. The signals are mutually consistent - a real, cryptographically sound flaw (Bleichenbacher is a well-established attack class) but one gated behind authenticated bucket access and a non-trivial, non-automatable oracle attack, placing it firmly as a scheduled-remediation item rather than an imminent widespread-exploitation threat. Note the privileged precondition means this is primarily an insider or compromised-credential / cross-tenant risk rather than an anonymous internet threat.

An authenticated user (or an attacker with stolen credentials) who can read encrypted objects in an S3 bucket and modify their metadata edits an object's stored padding-scheme field to downgrade it to legacy PKCS#1 v1.5. They then repeatedly submit modified ciphertexts to the decrypting application, using the differences in responses as a Bleichenbacher padding oracle to recover the RSA-wrapped envelope key and ultimately decrypt the targeted object. No public exploit code was identified at time of analysis, and the attack requires many adaptive queries, so it is practical but not point-and-click.