AWS Nitro Enclaves SDK for C hit by use-after-free and KMS impersonation flaws
VULNERABILITYAmazon Web Servicesredteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 8.7
- Exploited
- Not known
- Sources
- 1
What happened
Amazon has disclosed two security flaws in a software kit used to build protected, isolated environments on its cloud servers. One could let a malicious program on the host server run its own code inside the protected environment. The other could let an attacker pretend to be Amazon's key management service and feed it fake information.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Vulnerabilities
- CVE-2026-119116CVSS 8.7A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code
- CVE-2026-119148CVSS 8.2Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.
Full story timeline · 3 updates
Who reported · 1 outlet
AWS Security Bulletins
Who and what is in it
Companies