CVE-2026-19642: CWE-787 Out-of-bounds write in AWS aws-sdk-cpp
Bulletin ID: 2026-080-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/12/2026 12:30 PM PDT Description: The AWS SDK for C++ is an open-source library that provides C++ developers with APIs for AWS services. Its core library includes a Base64 codec used by the generated service clients for a variety of features.We identified the following CVEs: - CVE-2026-19642 - Out-of-bounds write in the Base64 decoder in the AWS SDK for C++ - CVE-2026-19643 - Out-of-bounds read in the Base64 decoder in the AWS SDK for C++ For CVE-2026-19642, certain inputs to the Base64 decoder might cause the decoder to write past the end of its heap-allocated output buffer, which might crash or corrupt memory in the process performing the decode. Remote code execution has not been demonstrated. For CVE-2026-19643, certain inputs to the Base64 decoder, on some platforms, might cause the decoder to read outside the bounds of its decode table, which might crash the process performing the decode. For both issues, impact is confined to the process of the application performing the decode. Impacted Versions: AWS SDK for C++: <= 1.11.861 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
AI Analysis
Technical Summary
The AWS SDK for C++ contains a Base64 decoder used by service clients. CVE-2026-19642 describes an out-of-bounds write vulnerability where certain crafted inputs cause the decoder to write beyond the allocated output buffer. This can result in memory corruption or application crashes. The vulnerability affects versions up to 1.11.861. Although remote code execution has not been shown, the impact is limited to the process performing the decode. AWS has acknowledged the issue and provides a security bulletin with remediation guidance. The SDK is a cloud service component, and AWS manages patching for the cloud environment.
Potential Impact
The vulnerability can cause application crashes or memory corruption in processes using the vulnerable Base64 decoder in the AWS SDK for C++. There is no confirmed remote code execution or data confidentiality impact. The impact is confined to the affected process performing the decode operation.
Mitigation Recommendations
A patch is available for this vulnerability. Since the AWS SDK for C++ is a cloud service component, AWS manages remediation for the cloud-hosted service. Users should refer to the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-080-aws/ for the latest patch and mitigation instructions. Applying the official patch or updating to a fixed version is recommended to address this issue.
CVE-2026-19642: CWE-787 Out-of-bounds write in AWS aws-sdk-cpp
Description
Bulletin ID: 2026-080-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/12/2026 12:30 PM PDT Description: The AWS SDK for C++ is an open-source library that provides C++ developers with APIs for AWS services. Its core library includes a Base64 codec used by the generated service clients for a variety of features.We identified the following CVEs: - CVE-2026-19642 - Out-of-bounds write in the Base64 decoder in the AWS SDK for C++ - CVE-2026-19643 - Out-of-bounds read in the Base64 decoder in the AWS SDK for C++ For CVE-2026-19642, certain inputs to the Base64 decoder might cause the decoder to write past the end of its heap-allocated output buffer, which might crash or corrupt memory in the process performing the decode. Remote code execution has not been demonstrated. For CVE-2026-19643, certain inputs to the Base64 decoder, on some platforms, might cause the decoder to read outside the bounds of its decode table, which might crash the process performing the decode. For both issues, impact is confined to the process of the application performing the decode. Impacted Versions: AWS SDK for C++: <= 1.11.861 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CVSS v3.1
Score 5.9medium
Affected software
AWS
aws-sdk-cpp
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The AWS SDK for C++ contains a Base64 decoder used by service clients. CVE-2026-19642 describes an out-of-bounds write vulnerability where certain crafted inputs cause the decoder to write beyond the allocated output buffer. This can result in memory corruption or application crashes. The vulnerability affects versions up to 1.11.861. Although remote code execution has not been shown, the impact is limited to the process performing the decode. AWS has acknowledged the issue and provides a security bulletin with remediation guidance. The SDK is a cloud service component, and AWS manages patching for the cloud environment.
Potential Impact
The vulnerability can cause application crashes or memory corruption in processes using the vulnerable Base64 decoder in the AWS SDK for C++. There is no confirmed remote code execution or data confidentiality impact. The impact is confined to the affected process performing the decode operation.
Mitigation Recommendations
A patch is available for this vulnerability. Since the AWS SDK for C++ is a cloud service component, AWS manages remediation for the cloud-hosted service. Users should refer to the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-080-aws/ for the latest patch and mitigation instructions. Applying the official patch or updating to a fixed version is recommended to address this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-08-12T16:49:37.222Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-080-aws/","vendor":"AWS"}]
Threat ID: 6a7cd124bf8831d53911d044
Added to database: 08/12/2026, 20:01:40 UTC
Last enriched: 08/12/2026, 20:19:35 UTC
Last updated: 09/25/2026, 01:47:41 UTC
Views: 74
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.