Junglewise Threat Intelligence

CVE-2026-35559: Amazon Athena ODBC driver out-of-bounds write in query processing

CVE-2026-35559 · Severity: medium · CVSS 6.5 · Published 2026-04-03

Technologies: Amazon Athena Odbc, Apple macOS, Microsoft Windows, Linux Kernel. Vendors: Amazon, Apple, Microsoft, Linux.

Executive brief

The Amazon Athena ODBC driver is a software component that allows applications to connect to and query data stored in Amazon Athena. A vulnerability in how the driver processes query data could allow an attacker to crash the driver, leading to a denial-of-service condition for applications relying on the connection. This could disrupt business operations and data analysis workflows that depend on automated database queries.

Technical details

An out-of-bounds write vulnerability (CWE-787) exists in the query processing components of the Amazon Athena ODBC driver prior to version 2.1.0.0. The flaw is triggered when the driver processes specially crafted data or table metadata during query operations. An attacker could exploit this by providing malicious input that causes the driver to write data outside of allocated memory buffers, resulting in a crash (Denial of Service). While the attack vector is network-based, it typically requires some form of user interaction or the processing of specific query results. The issue has been resolved in version 2.1.0.0 by improving input validation and memory handling during query processing.

Affected products

  • Amazon Athena ODBC driver < 2.1.0.0

Timeline

  • 2026-03-20: patched: Version 2.1.0.0 released with security fixes.
  • 2026-04-03: disclosed: Initial CVE publication.

References

Related threats