CVE-2026-5190 is an out-of-bounds write vulnerability classified under CWE-787 in the aws-c-event-stream library versions prior to 0.6.0. The issue resides in the streaming decoder component where processing specially crafted event-stream messages from a malicious server can cause memory corruption on the client side. This memory corruption could enable an attacker to execute arbitrary code within the context of the affected client application. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting network attack vector with high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity. Remediation involves upgrading the library to version 0.6.0 or later.

Successful exploitation of this vulnerability can lead to arbitrary code execution on client systems using vulnerable versions of aws-c-event-stream. This compromises confidentiality, integrity, and availability of the affected client application. No known exploits are currently reported in the wild.

A fix is available by upgrading aws-c-event-stream to version 0.6.0 or later. Users should apply this update promptly to mitigate the vulnerability. Since this is a client-side library, upgrading the dependency in client applications is required. No additional vendor advisories indicate alternative mitigations or that no action is required.