CVE-2026-19643

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in AWS SDK for C++

Publication date: 2026-08-12

Last updated on: 2026-08-18

Assigner: AMZN

Description

An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-18

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-19643

EUVD

EUVD-2026-57524

Affected Vendors & Products

Vendor	Product	Version / Range
amazon	aws_software_development_kit	to 1.11.862 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-19643 is an out-of-bounds read vulnerability in the Base64 decoder of the AWS SDK for C++. This issue occurs when certain inputs cause the decoder to read outside the bounds of its decode table, potentially crashing the process performing the decode.

Detection Guidance

Detecting this vulnerability requires checking the version of the AWS SDK for C++ in use. Commands like 'aws --version' or inspecting project dependencies for 'aws-sdk-cpp' version <= 1.11.861 can help identify vulnerable installations.

Impact Analysis

The vulnerability can cause an application that processes crafted Base64-encoded input to crash. This impacts system availability and could disrupt services relying on the AWS SDK for C++.

Compliance Impact

This vulnerability primarily causes application crashes due to out-of-bounds reads in the Base64 decoder, which could lead to denial-of-service conditions. It does not directly expose or leak data, so it may not directly violate GDPR or HIPAA confidentiality requirements. However, repeated crashes could disrupt services handling personal or health data, potentially impacting availability and compliance with availability-related controls in these regulations.

Mitigation Strategies

Upgrade the AWS SDK for C++ to version 1.11.862 or later. This version replaces the vulnerable Base64 decoder with the AWS Common Runtime implementation, resolving the issue.

Hi! I’m here to help you understand CVE-2026-19643. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70