CVE-2026-19642: CWE-787 Out-of-bounds write in AWS aws-sdk-cpp
An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862.
AI Analysis
Technical Summary
The AWS SDK for C++ contains a Base64 decoder used by service clients. CVE-2026-19642 describes an out-of-bounds write vulnerability where certain crafted inputs cause the decoder to write beyond the allocated output buffer. This can result in memory corruption or application crashes. The vulnerability affects versions up to 1.11.861. Although remote code execution has not been shown, the impact is limited to the process performing the decode. AWS has acknowledged the issue and provides a security bulletin with remediation guidance. The SDK is a cloud service component, and AWS manages patching for the cloud environment.
Potential Impact
The vulnerability can cause application crashes or memory corruption in processes using the vulnerable Base64 decoder in the AWS SDK for C++. There is no confirmed remote code execution or data confidentiality impact. The impact is confined to the affected process performing the decode operation.
Mitigation Recommendations
A patch is available for this vulnerability. Since the AWS SDK for C++ is a cloud service component, AWS manages remediation for the cloud-hosted service. Users should refer to the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-080-aws/ for the latest patch and mitigation instructions. Applying the official patch or updating to a fixed version is recommended to address this issue.
CVE-2026-19642: CWE-787 Out-of-bounds write in AWS aws-sdk-cpp
Description
An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862.
CVSS v3.1
Score 5.9medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The AWS SDK for C++ contains a Base64 decoder used by service clients. CVE-2026-19642 describes an out-of-bounds write vulnerability where certain crafted inputs cause the decoder to write beyond the allocated output buffer. This can result in memory corruption or application crashes. The vulnerability affects versions up to 1.11.861. Although remote code execution has not been shown, the impact is limited to the process performing the decode. AWS has acknowledged the issue and provides a security bulletin with remediation guidance. The SDK is a cloud service component, and AWS manages patching for the cloud environment.
Potential Impact
The vulnerability can cause application crashes or memory corruption in processes using the vulnerable Base64 decoder in the AWS SDK for C++. There is no confirmed remote code execution or data confidentiality impact. The impact is confined to the affected process performing the decode operation.
Mitigation Recommendations
A patch is available for this vulnerability. Since the AWS SDK for C++ is a cloud service component, AWS manages remediation for the cloud-hosted service. Users should refer to the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-080-aws/ for the latest patch and mitigation instructions. Applying the official patch or updating to a fixed version is recommended to address this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-08-12T16:49:37.222Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://aws.amazon.com/security/security-bulletins/2026-080-aws/","vendor":"AWS"}]
Threat ID: 6a7cd124bf8831d53911d044
Added to database: 08/12/2026, 20:01:40 UTC
Last enriched: 08/12/2026, 20:19:35 UTC
Last updated: 08/13/2026, 01:32:23 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.