AWS: out-of-bounds write

Bulletin ID: 2026-080-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/12/2026 12:30 PM PDT Description: The AWS SDK for C++ is an open-source library that provides C++ developers with APIs for AWS services. Its core library includes a Base64 codec used by the generated service clients for a variety of features.We identified the following CVEs: CVE-2026-19642 - Out-of-bounds write in the Base64 decoder in the AWS SDK for C++ CVE-2026-19643 - Out-of-bounds read in the Base64 decoder in the AWS SDK for C++ For CVE-2026-19642 , certain inputs to the Base64 decoder might cause the decoder to write past the end of its heap-allocated output buffer, which might crash or corrupt memory in the process performing the decode. Remote code execution has not been demonstrated. For CVE-2026-19643 , certain inputs to the Base64 decoder, on some platforms, might cause the decoder to read outside the bounds of its decode table, which might crash the process performing the decode. For both issues, impact is confined to the process of the application performing the decode. Impacted versions:  AWS SDK for C++: Resolution: These issues have been addressed in AWS SDK for C++ version 1.11.862 , released August 3, 2026. The SDK's Base64 implementation now delegates to the implementation in the AWS Common Runtime . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Customers who vendor or statically link the SDK should confirm that their build consumes the updated aws-crt-cpp submodule, not only the updated SDK sources. Workarounds: There is no configuration or runtime option that avoids these issues. Upgrading is required. References: CVE-2026-19642 CVE-2026-19643 GHSA-wxx3-prfc-69xx GHSA-mxm9-xpf9-x66x Acknowledgement: We would like to thank Lucas Carvalho Cordeiro and Rafael Sa Menezes of the University of Manchester for collaborating on this issue through the coordinated vulnerability disclosure process. Please email aws-security@amazon.com with any security questions or concerns. "},"metadata":{"tags":[]}},{"fields":{"patternBoolean2":"false","id":"ams#rt-rich-textc2#pattern-data"},"metadata":{"tags":[{"name":"pattern-data","description":"Default pattern data","id":"ams#rt-rich-textc2#pattern-data","namespaceId":"rt-rich-text"}]}}]},"metadata":{"auth":{},"testAttributes":{}},"context":{"page":{"pageUrl":"https://aws.amazon.com/security/security-bulletins/2026-080-aws/"},"contentType":"page","environment":{"stage":"prod","region":"us-west-2"},"sdkVersion":"2.0.27"},"refMap":{"manifest.js":"cda3e8d042","rt-rich-text.js":"5043b0a87f","rt-rich-text.rtl.css":"6a04028f86","rt-rich-text.css":"98f5a6aee4","rt-rich-text.css.js":"3d619cc2e1","rt-rich-text.rtl.css.js":"ccdb945d3e"},"settings":{"templateMappings":{"patternHeading":"patternHeading","patternSubheading":"patternSubheading","patternDark":"patternBoolean2","title":"itemHeading","bodyText":"itemLongLoc"}}} CVE-2026-19642 & CVE-2026-19643 - Memory-safety issues in the Base64 decoder in the AWS SDK for C++ Bulletin ID: 2026-080-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/12/2026 12:30 PM PDT Description: The AWS SDK for C++ is an open-source library that provides C++ developers with APIs for AWS services. Its core library includes a Base64 codec used by the generated service clients for a variety of features.We identified the following CVEs: CVE-2026-19642 - Out-of-bounds write in the Base64 decoder in the AWS SDK for C++ CVE-2026-19643 - Out-of-bounds read in the Base64 decoder in the AWS SDK for C++ For CVE-2026-19642 , certain inputs to the Base64 decoder might cause the decoder to write past the end of its heap-allocated output buffer, which might crash or corrupt memory in the process performing the decode. Remote code execution has not been demonstrated. For CVE-2026-19643 , certain inputs to the Base64 decoder, on some platforms, might cause th

Severity from

no source yet

Also known as

CVE-2026-19643

• aws.amazon.com/security/security-bulletins/rss/2026-080-aws/
• www.cve.org/CVERecord?id=CVE-2026-19642
• www.cve.org/CVERecord?id=CVE-2026-19643