AWS Nitro Enclaves SDK for C hit by use-after-free and KMS impersonation flaws
- Severity
- High
- Highest CVSS
- 8.7
- Exploited
- Not known
- Sources
- 1
What happened
CVE-2026-119116 is a use-after-free in the SetClient command handler of kmstool-enclave; a process on the parent EC2 instance can send crafted vsock messages to corrupt enclave heap memory and achieve arbitrary code execution within the enclave. Only enclave images that include kmstool-enclave or code derived from it are affected. CVE-2026-119148 is an input validation issue in the library where the KMS server name is built from a caller-supplied region string, allowing KMS impersonation and injection of forged responses such as actor-chosen key material. Both affect aws-nitro-enclaves-sdk-c v0.4.5 and earlier (the first only for kmstool-enclave); defenders should identify enclave images built on these versions or derived from kmstool-enclave and consult the full AWS bulletin for fixed versions and guidance, as the excerpt does not state them.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Vulnerabilities
- CVE-2026-119116CVSS 8.7A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code
- CVE-2026-119148CVSS 8.2Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
Full story timeline · 3 updates
Who reported · 1 outlet
Who and what is in it
Companies