AWS Nitro Enclaves SDK for C hit by use-after-free and KMS impersonation flaws
VULNERABILITYAmazon Web Servicesredteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 8.7
- Exploited
- Not known
- Sources
- 1
What happened
AWS published bulletin 2026-157-AWS covering two issues in the AWS Nitro Enclaves SDK for C, affecting versions up to and including v0.4.5. CVE-2026-119116 is a use-after-free in the kmstool-enclave example application that lets an application on the parent EC2 instance send crafted vsock messages to run arbitrary code inside the enclave. CVE-2026-119148 is an input validation flaw in the SDK library that could let a third party impersonate KMS and inject forged responses.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Vulnerabilities
- CVE-2026-119116CVSS 8.7A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code
- CVE-2026-119148CVSS 8.2Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
Full story timeline · 3 updates
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies