EUVD-2026-57524Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable decoder crash triggered by authenticated low-privilege input; high complexity for platform-specific triggering; availability-only impact with no confidentiality or integrity effects.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
2DescriptionCVE.org
An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input.
To remediate this issue, users should upgrade to version 1.11.862.
AnalysisAI
Remote authenticated users can crash applications built on Amazon aws-sdk-cpp versions before 1.11.862 by supplying crafted Base64-encoded input that triggers an out-of-bounds read in the SDK's Base64 decoder. Exploitation is constrained to authenticated users, requires high attack complexity, and is platform-specific - not all deployments are vulnerable. The CVSS 4.0 vector (VA:H, VC:N, VI:N) confirms impact is limited to availability (denial of service); no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
The vulnerability is a CWE-125 (Out-of-Bounds Read) defect in the Base64 decoding routine of the Amazon AWS SDK for C++ (aws-sdk-cpp), the official C++ library for AWS service integration (CPE: cpe:2.3:a:aws:aws-sdk-cpp:*:*:*:*:*:*:*:*). Out-of-bounds reads in Base64 decoders typically arise from missing or incorrect bounds checks when processing padded, malformed, or non-standard input sequences, causing the decoder to read past the allocated buffer. The 'on some platforms' qualifier indicates the bug's manifestation is architecture- or compiler-dependent, likely stemming from platform differences in integer widths, memory alignment, or how undefined behavior is resolved by the underlying toolchain. Applications that accept externally-supplied Base64 data and pass it through the SDK decoder without prior sanitization represent the core attack surface.
RemediationAI
Upgrade aws-sdk-cpp to version 1.11.862 or later, which resolves the out-of-bounds read in the Base64 decoder; the release is available at https://github.com/aws/aws-sdk-cpp/releases/tag/1.11.862 with vendor details at https://aws.amazon.com/security/security-bulletins/2026-080-aws/. As a compensating control prior to patching, applications can validate and reject malformed or non-canonical Base64-encoded input before passing it to the SDK decoder - for example, enforcing strict character set and padding rules at the application boundary - which reduces exposure without requiring an immediate SDK upgrade. Note that application-layer input validation introduces additional processing overhead and does not eliminate the underlying library defect; it should be treated as a temporary measure only.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today