Search: CVE-2026-119148

CVE-2026-119148 is a vulnerability in AWS aws-nitro-enclaves-sdk-c before version 0.4.6 involving incomplete string validation. This flaw may allow an attacker to impersonate the AWS KMS endpoint. The issue is fixed in version 0.4.6, and users are advised to rebuild any custom enclave images using the updated SDK version.

Two vulnerabilities were identified in the AWS Nitro Enclaves SDK for C affecting versions up to v0.4.5. CVE-2026-119116 is a use-after-free flaw in the kmstool-enclave example application that allows a parent EC2 instance application to send crafted messages over vsock to corrupt heap memory inside the enclave and execute arbitrary code. CVE-2026-119148 is an input validation issue in the SDK library where a crafted region string can cause the enclave to accept forged AWS KMS server responses, potentially injecting malicious key material. Only enclave images including kmstool-enclave or derived code are affected by the first issue; the second affects the SDK library generally.