CVE-2026-119148

MediumCVSS 6.5

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.

Risk Assessment

An attacker may impersonate the AWS KMS endpoint, potentially leading to disclosure or manipulation of authentication data within the enclave environment. This affects confidentiality and integrity of KMS communication.

Recommendation

Rebuild custom enclave images against aws-nitro-enclaves-sdk-c version 0.4.6 or later. Verify that all deployed images use the fixed SDK version.

Other vulnerabilities in aws-nitro-enclaves-sdk-c

CVE-2026-119116High
A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave. To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.

Original NVD description (English source)

Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS