Description

An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T20:17:42.800Z",
  "pubdate": "2026-08-12T20:17:42.800Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists within the Base64 decoder implementation of the Amazon aws-sdk-cpp software development kit prior to version 1.11.862. This memory safety defect affects the decoding routines utilized across various platforms when processing untrusted data payloads.\nThe primary security impact of this vulnerability is application availability denial, manifesting as a crash or unexpected termination of the host process when parsing specifically crafted Base64-encoded inputs. Although remote code execution is not inherently detailed, improper bounds checking during decoding introduces memory exposure and instability risks.\nThe affected product is Amazon aws-sdk-cpp across versions prior to 1.11.862 on applicable platforms. Risk implications center on service disruption and potential denial of service conditions for applications relying on the SDK for data ingestion and processing workflows.\nExploitation of this flaw requires an attacker to possess remote authenticated access privileges capable of supplying maliciously crafted Base64-encoded input to the target application. The vulnerability is triggered during standard processing routines where the decoding engine fails to validate input lengths against allocated buffer boundaries properly.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate bounds validation within the Base64 decoder component of Amazon aws-sdk-cpp before version 1.11.862. During the translation of Base64-encoded character strings into raw binary data, the decoding algorithm improperly calculates input lengths or destination buffer sizes on specific target platforms, leading to memory read operations past the allocated boundaries of the input buffer.\nThe vulnerable component resides specifically in the Base64 decoding routines responsible for parsing serialized data, authentication tokens, or payload transfers within the SDK. The flaw is exposed whenever an application processes external or untrusted data streams that leverage the internal Base64 decoding utility functions.\nThe attack flow proceeds as follows: First, a remote authenticated user crafts a maliciously structured Base64-encoded payload designed to exploit the faulty length calculation logic within the decoder. Second, the user submits this crafted input to the target application utilizing the vulnerable Amazon aws-sdk-cpp library. Third, the application passes the input to the SDK's Base64 decoder for processing. Fourth, during the decoding loop, the algorithm attempts to read memory beyond the legitimate bounds of the input buffer due to missing or flawed index checks.\nThis out-of-bounds read triggers an access violation or segmentation fault depending on the operating system and platform memory architecture, immediately terminating the host application process and resulting in a denial of service condition. Authentication is required to interact with the service and supply the input payload, but no elevated privilege requirements beyond standard user authentication are specified for triggering the crash condition."
}