🟠 High | Source: AWS Security Bulletins
Two memory-safety vulnerabilities have been identified in the Base64 decoder within the AWS SDK for C++, affecting all versions up to and including 1.11.861. CVE-2026-19642 allows certain inputs to trigger an out-of-bounds heap write, which could crash or corrupt the application’s memory, whilst CVE-2026-19643 may cause an out-of-bounds read on some platforms, potentially crashing the process. Although remote code execution has not been demonstrated, the potential for memory corruption makes these issues significant for any application using the affected SDK.
Security Architect’s Take: Audit your C++ application estate for any direct or transitive use of the AWS SDK for C++ at version 1.11.861 or below, and prioritise upgrading to the patched release — paying particular attention to internet-facing services that accept untrusted input which may flow through the Base64 decoder.
Original advisory: CVE-2026-19642 & CVE-2026-19643 - Memory-safety issues in the Base64 decoder in the AWS SDK for C++