CVE-2026-3338

HighCVSS 7.5

Published: 02/03/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.78%

52th percentile - higher than 52% of all known CVEs

Summary

A vulnerability in the AWS-LC library's PKCS7_verify() function involves improper signature validation, allowing an unauthenticated attacker to bypass signature verification when processing PKCS7 objects with authenticated attributes.

Risk Assessment

The organization may be at risk of accepting forged or modified digitally signed data, potentially compromising the integrity and authenticity of processed information.

Recommendation

Upgrade the AWS-LC library to version 1.69.0 or later. Customers of AWS services do not need to take any action.

Other vulnerabilities in AWS-LC

CVE-2026-3336High
A vulnerability in the PKCS7_verify() function in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer.

Original NVD description (English source)

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.