{"id":"CVE-2025-14760","aliases":["EUVD-2025-203941","GHSA-792f-r46x-r7gm","OESA-2026-3687","OESA-2026-3688","OESA-2026-3689","OESA-2026-3869"],"status":"published","title":"aws-sdk-cpp security update","description":"Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \"instruction file\" instead of S3's metadata record.\n\nTo mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00168,"percentile":0.06204,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-327"],"published":"2025-12-17T20:11:37Z","modified":"2026-10-28T10:51:37Z","affected":[{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"aws-sdk-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.327-4.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"aws-sdk-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.327-5.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"aws-sdk-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.327-5.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"aws-sdk-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.327-5.oe2403sp4"}]}],"bundled":3}],"products":[{"vendor":"aws","product":"aws sdk for c++"}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/AWS-2025-032/","tags":["vendor-advisory","advisory"]},{"url":"https://github.com/aws/aws-sdk-cpp/security/advisories/GHSA-792f-r46x-r7gm","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/aws/aws-sdk-cpp/releases/tag/1.11.712","tags":["patch","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14760.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14760","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19643","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3688","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3689","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3869","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-14760","description":"Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \"instruction file\" instead of S3's metadata record.\n\nTo mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later","status":"published","published":"2025-12-17T20:11:37.47Z","modified":"2025-12-17T21:06:09.966Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:32:28.621398Z"}],"euvd":[{"id":"EUVD-2025-203941","description":"Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \"instruction file\" instead of S3's metadata record.\n\nTo mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later","status":"published","published":"2025-12-17T20:11:37Z","modified":"2025-12-17T21:06:09Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:03.481924Z"}],"nvd":[{"id":"CVE-2025-14760","description":"Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \"instruction file\" instead of S3's metadata record.\n\nTo mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later","status":"published","published":"2025-12-17T20:15:53.357Z","modified":"2026-06-17T08:36:31.157Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T14:11:51.309584Z"}],"osv":[{"id":"CVE-2025-14760","description":"Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \"instruction file\" instead of S3's metadata record.\n\nTo mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later","status":"published","published":"2025-12-17T20:11:37.47Z","modified":"2026-10-28T10:51:37.979457531Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-327"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"OESA-2026-3687","title":"aws-sdk-cpp security update","description":"The AWS SDK for C++ provides a modern C++ (version C++ 11 or later) interface  for Amazon Web Services (AWS). This package contains the S3 component.\r\n\r\nSecurity Fix(es):\n\nMissing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \u0026quot;instruction file\u0026quot; instead of S3\u0026apos;s metadata record.\n\nTo mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later(CVE-2025-14760)\n\nAn out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input.\n\n\n\nTo remediate this issue, users should upgrade to version 1.11.862.(CVE-2026-19642)\n\nAn out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input.\n\n\n\nTo remediate this issue, users should upgrade to version 1.11.862.(CVE-2026-19643)","status":"published","published":"2026-09-05T15:03:56Z","modified":"2026-09-05T15:16:37.127369758Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3688","title":"aws-sdk-cpp security update","description":"The AWS SDK for C++ provides a modern C++ (version C++ 11 or later) interface  for Amazon Web Services (AWS). This package contains the S3 component.\r\n\r\nSecurity Fix(es):\n\nMissing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \u0026quot;instruction file\u0026quot; instead of S3\u0026apos;s metadata record.\n\nTo mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later(CVE-2025-14760)\n\nAn out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input.\n\n\n\nTo remediate this issue, users should upgrade to version 1.11.862.(CVE-2026-19642)\n\nAn out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input.\n\n\n\nTo remediate this issue, users should upgrade to version 1.11.862.(CVE-2026-19643)","status":"published","published":"2026-09-05T15:03:57Z","modified":"2026-09-05T15:16:35.440197609Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3689","title":"aws-sdk-cpp security update","description":"The AWS SDK for C++ provides a modern C++ (version C++ 11 or later) interface  for Amazon Web Services (AWS). This package contains the S3 component.\r\n\r\nSecurity Fix(es):\n\nMissing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \u0026quot;instruction file\u0026quot; instead of S3\u0026apos;s metadata record.\n\nTo mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later(CVE-2025-14760)\n\nAn out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input.\n\n\n\nTo remediate this issue, users should upgrade to version 1.11.862.(CVE-2026-19642)\n\nAn out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input.\n\n\n\nTo remediate this issue, users should upgrade to version 1.11.862.(CVE-2026-19643)","status":"published","published":"2026-09-05T15:03:57Z","modified":"2026-09-05T15:16:37.280335424Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3869","title":"aws-sdk-cpp security update","description":"The AWS SDK for C++ provides a modern C++ (version C++ 11 or later) interface  for Amazon Web Services (AWS). This package contains the S3 component.\r\n\r\nSecurity Fix(es):\n\nMissing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an \u0026quot;instruction file\u0026quot; instead of S3\u0026apos;s metadata record.\n\nTo mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later(CVE-2025-14760)\n\nAn out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that processes crafted Base64-encoded input.\n\n\n\nTo remediate this issue, users should upgrade to version 1.11.862.(CVE-2026-19642)\n\nAn out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input.\n\n\n\nTo remediate this issue, users should upgrade to version 1.11.862.(CVE-2026-19643)","status":"published","published":"2026-09-14T16:35:10Z","modified":"2026-09-13T16:45:52.352306481Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"}]}}