EUVD-2026-57522Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires authentication (PR:L) and specific preconditions (AC:H); primary impact is high availability disruption (A:H) from crash, with minor heap integrity risk (I:L) and no confidentiality impact.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input.
To remediate this issue, users should upgrade to version 1.11.862.
AnalysisAI
Out-of-bounds write in the Base64 decoder of Amazon's aws-sdk-cpp (all versions before 1.11.862) exposes applications to heap memory corruption or crash when processing attacker-supplied Base64-encoded content. Remote authenticated attackers can trigger the defect by submitting crafted input to any application built on this SDK that routes user-controlled data through the affected decoder path. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, though the CWE-787 heap write class carries inherent tail risk beyond the denial-of-service primary impact.
Technical ContextAI
The flaw resides in the Base64 decoding routine within aws-sdk-cpp (CPE: cpe:2.3:a:aws:aws-sdk-cpp), Amazon's widely adopted C++ library for interacting with AWS services. CWE-787 (Out-of-bounds Write) characterizes defects where a program writes data past the end of an allocated buffer - here, the Base64 decoder overruns a heap buffer when handling malformed or adversarially crafted input. In C++ heap environments, such writes can corrupt allocator metadata, overwrite adjacent objects, or cause deterministic crashes depending on the allocator in use and heap layout at runtime. The CVSS 4.0 vector's AT:P (Attack Requirements: Present) metric signals that the vulnerability manifests only under specific application usage patterns - specifically when the SDK's Base64 decoder is invoked on attacker-controlled input within the application's code path, rather than on purely SDK-internal data.
RemediationAI
Upgrade aws-sdk-cpp to version 1.11.862 or later, as confirmed by the tagged release at https://github.com/aws/aws-sdk-cpp/releases/tag/1.11.862 and the AWS Security Bulletin at https://aws.amazon.com/security/security-bulletins/2026-080-aws/. Applications that cannot immediately upgrade should audit all code paths where user-supplied data reaches the SDK's Base64 decoder and implement application-level input length validation and character-set checks before passing content to the SDK - this reduces attack surface but does not eliminate the underlying flaw and may need adjustment for large or binary-encoded payloads. Restricting access to endpoints that accept Base64-encoded user input to trusted or low-privilege authenticated roles is a compensating control with trade-offs in application functionality. No vendor-documented workarounds beyond patching are available.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today