CVE-2026-5190: CWE-787: Out-of-bounds Write in AWS aws-c-event-stream
CVE-2026-5190 is a high-severity vulnerability in the aws-c-event-stream library prior to version 0. 6. 0. It involves an out-of-bounds write in the streaming decoder component that could allow a malicious server to cause memory corruption in a client application processing crafted event-stream messages. This memory corruption may lead to arbitrary code execution on the client side. The issue can be remediated by upgrading to version 0. 6. 0 or later.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-5190) affects the aws-c-event-stream library used by AWS. The flaw is an out-of-bounds write in the streaming decoder component before version 0.6.0. A third party operating a server can exploit this by sending specially crafted event-stream messages to a client application, causing memory corruption. This corruption may enable arbitrary code execution on the client. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction and high attack complexity. A patch is available in version 0.6.0 and later.
Potential Impact
Successful exploitation can lead to arbitrary code execution on client applications processing malicious event-stream messages, compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires a malicious server to send crafted messages and user interaction on the client side. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Users should upgrade aws-c-event-stream to version 0.6.0 or later to remediate this vulnerability. Since a patch is available, applying this official fix is the recommended mitigation. No additional vendor advisory indicates alternative or temporary mitigations.
CVE-2026-5190: CWE-787: Out-of-bounds Write in AWS aws-c-event-stream
Description
CVE-2026-5190 is a high-severity vulnerability in the aws-c-event-stream library prior to version 0. 6. 0. It involves an out-of-bounds write in the streaming decoder component that could allow a malicious server to cause memory corruption in a client application processing crafted event-stream messages. This memory corruption may lead to arbitrary code execution on the client side. The issue can be remediated by upgrading to version 0. 6. 0 or later.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-5190) affects the aws-c-event-stream library used by AWS. The flaw is an out-of-bounds write in the streaming decoder component before version 0.6.0. A third party operating a server can exploit this by sending specially crafted event-stream messages to a client application, causing memory corruption. This corruption may enable arbitrary code execution on the client. The vulnerability has a CVSS 3.1 score of 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction and high attack complexity. A patch is available in version 0.6.0 and later.
Potential Impact
Successful exploitation can lead to arbitrary code execution on client applications processing malicious event-stream messages, compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires a malicious server to send crafted messages and user interaction on the client side. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Users should upgrade aws-c-event-stream to version 0.6.0 or later to remediate this vulnerability. Since a patch is available, applying this official fix is the recommended mitigation. No additional vendor advisory indicates alternative or temporary mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- AMZN
- Date Reserved
- 2026-03-30T20:05:41.435Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69cc068ae6bfc5ba1d2beeed
Added to database: 3/31/2026, 5:38:18 PM
Last enriched: 4/8/2026, 4:17:24 AM
Last updated: 5/15/2026, 10:36:59 PM
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.