The vulnerability CVE-2026-3338 in AWS-LC involves improper verification of cryptographic signatures (CWE-347) in the PKCS7_verify() function. This weakness permits an unauthenticated user to bypass signature verification when handling PKCS7 objects that include Authenticated Attributes. The issue affects AWS-LC version 1.41.0. AWS manages remediation for its cloud services, so customers using AWS services are not required to act. However, applications directly using AWS-LC should upgrade to version 1.69.0 where the issue is fixed. The CVSS 3.1 score is 7.5 (high severity) with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An unauthenticated attacker can bypass signature verification in PKCS7 objects with Authenticated Attributes, potentially allowing integrity violations in cryptographic operations relying on AWS-LC. This could lead to acceptance of forged or tampered data as valid. There is no impact on confidentiality or availability. The vulnerability affects the integrity of signature verification processes.

AWS manages remediation for this vulnerability in its cloud services, so customers using AWS services do not need to take action. Applications using AWS-LC directly should upgrade to AWS-LC version 1.69.0, which contains the fix for this issue. Patch status is confirmed as available. Refer to the vendor advisories at https://aws.amazon.com/security/security-bulletins/2026-005-AWS/ and https://access.redhat.com/security/cve/CVE-2026-3338 for detailed guidance.