Description

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-12T20:17:42.653Z",
  "pubdate": "2026-08-12T20:17:42.653Z",
  "executiveSummary": "An out-of-bounds write vulnerability exists within the Base64 decoder component of Amazon aws-sdk-cpp prior to version 1.11.862. This memory corruption flaw arises when processing maliciously crafted Base64-encoded input data. An authenticated remote attacker capable of supplying specifically formatted payloads to an application utilizing the vulnerable SDK can trigger severe memory corruption or application crashes. The impact of successful exploitation includes denial of service through application termination and potential heap memory corruption, which under specific conditions may introduce further stability or integrity risks. The attack vector requires the targeted application to decode untrusted Base64 input processed by the vulnerable decoder function within Amazon aws-sdk-cpp. Remediation requires upgrading the affected library to the patched version 1.11.862 to ensure proper bounds checking during the decoding process.",
  "technicalDetails": "The vulnerability resides in the Base64 decoding implementation utilized by Amazon aws-sdk-cpp prior to version 1.11.862. The root cause is an out-of-bounds write flaw, indicative of insufficient bounds validation and incorrect buffer length calculations when translating Base64-encoded byte streams into raw binary data. During normal operation, the Base64 decoder parses input strings, calculates output buffer requirements, and writes decoded bytes into destination memory structures. However, when presented with a specially crafted, malformed, or maliciously engineered Base64 input, the decoding logic miscalculates the required buffer allocation or fails to enforce strict boundaries on the write pointer. This results in data being written past the allocated boundaries of the heap-based buffer, causing heap memory corruption.\nThe attack flow requires an authenticated remote user or entity to supply crafted Base64-encoded input to an application that incorporates the vulnerable Amazon aws-sdk-cpp library. As the application passes this untrusted input to the Base64 decoder component, the flawed decoding routine executes. Because input validation is insufficient, the routine overruns the destination heap buffer, overwriting adjacent memory regions. Depending on the memory layout and heap architecture, this out-of-bounds write corrupts critical heap metadata or adjacent application data structures. The immediate consequence of this memory corruption is typically an immediate application crash due to segmentation faults or heap corruption detection mechanisms terminating the process. In more complex scenarios, arbitrary heap corruption can destabilize the runtime environment, leading to unpredictable application behavior.\nPrerequisites for exploitation include network exposure to the application endpoint that consumes the Base64 input, and authentication status sufficient to interact with the vulnerable functionality. The payload behavior relies entirely on the structural manipulation of the Base64 encoding to trick the decoder into writing beyond the designated allocation boundary. No specific post-exploitation capabilities or privilege escalation vectors beyond the immediate application crash and memory corruption are detailed, but heap corruption vulnerabilities inherently possess a high severity profile due to their potential to disrupt core runtime integrity."
}