CVE-2025-14763 is a vulnerability in the AWS S3 Encryption Client for Java involving the use of a broken or risky cryptographic algorithm due to missing cryptographic key commitment. This allows an attacker with write access to an S3 bucket to insert a manipulated encrypted data key (EDK) that decrypts to altered plaintext when stored in an instruction file instead of S3 metadata. The issue affects data integrity but does not compromise confidentiality or availability. Exploitation requires network access and low privileges, with no user interaction. AWS has addressed this vulnerability in version 4.0.0 or later of the client.

The vulnerability impacts data integrity by allowing an attacker with write access to manipulate encrypted data keys, potentially causing decrypted data to differ from the original. Confidentiality and availability of data are not affected. There is no evidence of exploitation in the wild. The attack requires network access and low privileges, making it feasible in environments where write permissions to S3 buckets are not properly restricted.

AWS has fixed this vulnerability in version 4.0.0 or later of the S3 Encryption Client for Java. Organizations should upgrade to this fixed version promptly. Additionally, it is recommended to audit and restrict S3 bucket write permissions to minimize the risk of exploitation. Patch status is confirmed by the vendor advisory indicating an official fix is available.