CVE-2026-3336

HighCVSS 7.5

Published: 02/03/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.77%

51th percentile - higher than 51% of all known CVEs

Summary

A vulnerability in the PKCS7_verify() function in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

Risk Assessment

An attacker can supply a malicious signed PKCS7 object that is accepted as valid, potentially leading to data integrity or authentication bypass in applications using AWS-LC.

Recommendation

Upgrade AWS-LC to version 1.69.0 or later. Customers of AWS services do not need to take action.

Other vulnerabilities in AWS-LC

CVE-2026-3338High
A vulnerability in the AWS-LC library's PKCS7_verify() function involves improper signature validation, allowing an unauthenticated attacker to bypass signature verification when processing PKCS7 objects with authenticated attributes.

Original NVD description (English source)

Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.