CVE-2026-84851

HighCVSS 7.5

Published: 03/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 03/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.

Risk Assessment

The risk includes the possibility of remotely causing application crashes, which could lead to service disruptions and system unavailability.

Recommendation

It is recommended to upgrade the Amazon Ion-C library to version 1.1.6 or later, which includes the fix. Also, monitor systems for unusual input data.

Other vulnerabilities in Amazon Ion-C

CVE-2025-12829Medium
An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS