CVE-2025-12829

MediumCVSS 6.2

Published: 07/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.

Risk Assessment

An attacker may potentially access sensitive data in memory, leading to a confidentiality breach. The risk affects applications using Amazon Ion-C versions earlier than v1.1.4.

Recommendation

Upgrade the Amazon Ion-C library to version v1.1.4 or later. Analyze whether used applications are vulnerable and plan the update.

Other vulnerabilities in Amazon Ion-C

CVE-2026-84851High
An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS