Executive brief
The AWS SDK for C++ contains memory-safety vulnerabilities in its Base64 decoder component used for encoding and decoding data in AWS API requests and responses. An attacker who can supply malicious Base64-encoded input to an application using the affected SDK could trigger memory corruption, potentially leading to application crashes, information disclosure, or remote code execution depending on the nature of the memory safety issue.
Technical details
Two distinct memory-safety issues (CVE-2026-19642 and CVE-2026-19643) have been identified in the Base64 decoder of the AWS SDK for C++. These vulnerabilities likely involve buffer overflow, heap corruption, or use-after-free conditions in the decoding logic. The attack vector is network-based, as the decoder processes Base64-encoded data received in AWS API responses or user-supplied input. Exploitation may require specific preconditions such as processing of specially crafted Base64 sequences. The impact ranges from denial of service (application crash) to potential information disclosure or code execution. Patches are expected from AWS; users should consult the security advisory for remediation guidance and updated SDK versions.
Affected products
- AWS AWS SDK for C++
CVE identifiers
- CVE-2026-19642
- CVE-2026-19643
Timeline
- 2026-09-09: disclosed