CVE-2026-19642

Executive Summary

CVE-2026-19642 is an out-of-bounds write vulnerability in the Base64 decoder of the Amazon AWS SDK for C++ (aws-sdk-cpp) affecting all versions prior to 1.11.862. A remote authenticated user can submit crafted Base64-encoded input to an application built with the vulnerable library, potentially causing a crash or heap memory corruption in the decoding process. The flaw is rated medium severity (CVSS 5.9) with no public exploit code, no CISA KEV listing, and low current exploit probability; remediation requires upgrading to aws-sdk-cpp 1.11.862.

Technical Analysis

The vulnerable component is the Base64 decoding routine in aws-sdk-cpp, the official C++ software development kit for Amazon Web Services. Base64 decoding is an inverse mapping operation: four ASCII characters (with optional = padding) decode into three binary bytes. Decoders therefore need to compute the exact output buffer size from the encoded length and must enforce write-pointer bounds while processing each character quadruple and the final padding block.

An out-of-bounds write (CWE-787) in this code path indicates a failure in output-size accounting or missing bounds enforcement during the write loop. Likely structural trigger conditions include:

• Input lengths that are not a multiple of four, combined with trailing padding, causing the decoder to emit more bytes than the allocated floor(len*3/4) buffer capacity.
• Non-canonical or malformed padding (e.g., two = signs where only one is valid, or padding followed by additional characters) leading to an over-write on the final partial block.
• Character sets or embedded data that cause the internal write index to advance past the reserved output region before the terminating condition is evaluated.

Because aws-sdk-cpp is a compile-time dependency, the vulnerable decoder is compiled directly into every application that consumes the SDK. Any application feature that decodes Base64 data derived from remote input is a candidate sink — for example, decoding of token material, encoded blob fields, or Base64-wrapped request parameters. The NVD description constrains the preconditions: the attacker must be an authenticated user of the target application (PR:L), the attack requires high complexity (AC:H), and no user interaction is needed (UI:N). This is consistent with a parser defect that only triggers under precisely engineered input length and padding combinations. The CVSS sub-scores (C:N, I:L, A:H) indicate that the observable consequence is primarily service availability loss (crash) with a limited integrity effect if heap corruption alters adjacent in-memory data. No confidentiality impact is modeled.

Insufficient technical detail is available in the public description to identify specific function names, buffer sizes, or a reproducer. The exact corruption primitive — overwrite offset, required heap grooming, and whether a controlled write is achievable — remains unknown. What is known with high confidence is the vulnerability class (out-of-bounds write in a decoder), the affected version line, and the availability-oriented impact.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template has been identified for CVE-2026-19642. The attack chain below is inferred strictly from the vulnerability class and the CVSS preconditions and should be treated as an analytical model rather than a confirmed exploit path.

1. Reconnaissance / target identification: The attacker identifies an application or service built with aws-sdk-cpp prior to 1.11.862. Since the SDK is statically linked in most C++ deployments, it is not directly banner-fingerprintable. The attacker would instead profile applications that expose authenticated functionality accepting Base64-encoded payloads — typical of AWS-integrated C++ backends, blob processing services, and S3-compatible gateways. The authentication requirement (PR:L) means the attacker must already hold valid user credentials for the target application.

2. Triggering the flaw: After authenticating, the attacker submits a crafted Base64 string through the application feature that feeds input to the SDK decoder. The string is engineered around the edge-case conditions described above — specifically, unusual encoded-length and padding combinations that cause the decoder’s output-size calculation to produce an undersized buffer while the write loop continues past its end.

3. Payload / execution method (vulnerability-class level): The decoder performs an out-of-bounds write to the heap. In the simplest case the write hits an unmapped or guard page and the process crashes immediately — corresponding to the high availability impact (A:H). In a more controlled scenario, the overwrite lands in adjacent heap metadata or neighboring objects, potentially corrupting in-memory values that the application later trusts — corresponding to the low integrity impact (I:L). No public evidence indicates that the primitive is sufficient for arbitrary code execution; the NVD scoring (C:N) suggests no data disclosure channel.

4. Post-exploitation impact: The most realistic outcome is denial of service — the attacker repeatedly submits crafted inputs to crash request-handling processes or threads, causing service instability, failed transactions, and potential cascading restarts in containerized or auto-scaling deployments. If heap layout can be influenced, targeted integrity corruption of decoded data may affect downstream application logic. No threat-actor campaign, in-the-wild exploitation, or CISA KEV listing has been reported for this CVE as of this report.

Impact Assessment

• Affected systems: Any C++ application or service statically or dynamically linked against aws-sdk-cpp versions prior to 1.11.862 that decodes Base64 data derived from remote, authenticated input. The AWS SDK for C++ is widely used in backend services, data-processing pipelines, and AWS-integrated tooling, so the vulnerable population is broad.
• Business impact: The dominant risk is availability (CVSS A:H). A memory-corruption crash in a request-handling process can cause service downtime, transaction failures, and operational overhead from forced restarts. The integrity sub-score (I:L) suggests limited risk of corrupted in-memory data affecting business logic; confidentiality is not affected.
• Blast radius: The library’s ubiquity across AWS-adjacent infrastructure makes the attack surface wide, but the high attack complexity (AC:H) and the authentication requirement (PR:L) meaningfully reduce the practical exploitability. The impact is constrained to the application process and does not cross a security boundary (S:U).
• Exploit likelihood: EPSS score 0.00295 (22nd percentile of exploited CVEs) indicates low current exploitation activity. No PoC, no exploit code, no Nuclei template, and no KEV entry exist at the time of writing. The overall CVSS base score is 5.9 (medium).

Detection Guidance

Detecting a library-level memory-corruption bug is challenging because the failure occurs inside the application process. The rules below are therefore organized around three observable signals: (a) anomalous Base64 payload shapes in network traffic, (b) crash and fault indicators in host logs, and (c) static fingerprints of vulnerable SDK versions in binaries and build artifacts. All rules are experimental and should be tuned against baseline traffic.

Sigma Rule

title: "CVE-2026-19642 AWS SDK C++ Base64 Decoder Crash Indicator"
id: 4f8c6e2a-1c3d-4e5f-9a0b-7c8d9e0f1a2b
status: experimental
description: >
  Detects Windows Error Reporting / Application Error events (Event ID 1000 or 1001)
  in a process whose faulting module or crash message references aws-sdk-cpp or AWS
  components. Intended to surface crashes consistent with the Base64 decoder
  out-of-bounds write (CWE-787). Requires triage to confirm causality.
logsource:
  product: windows
  service: application
detection:
  selection_crash:
    EventID:
      - 1000
      - 1001
    Provider_Name:
      - "Application Error"
      - "Windows Error Reporting"
  selection_aws:
    Message|contains:
      - "aws-sdk-cpp"
      - "aws-cpp"
      - "AWS"
  condition: selection_crash and selection_aws
falsepositives:
  - "Legitimate crashes in any AWS-related Windows component"
  - "Crash dumps containing SDK version strings from unrelated faults"
level: medium
tags:
  - attack.t1499.004
  - cve.2026-19642
  - cwe.787

YARA Rule

rule CVE_2026_19642_aws_sdk_cpp_base64_oob
{
    meta:
        author = "valtersit.com Threat Intelligence"
        date = "2026-02-01"
        description = "Identifies binaries, build artifacts, or container images referencing aws-sdk-cpp version 1.11.x, the version line affected by CVE-2026-19642 (Base64 decoder out-of-bounds write). Flagged artifacts must be manually confirmed to be older than 1.11.862."
        cve = "CVE-2026-19642"
        cwe = "CWE-787"
    strings:
        $sdk_name = "aws-sdk-cpp" ascii wide
        $ver_prefix = "1.11." ascii wide
        $ver_pattern = /1\.11\.\d{1,3}/ ascii
    condition:
        $sdk_name and $ver_prefix and $ver_pattern
}

Suricata IDS Rule

# CVE-2026-19642 — Experimental network detection.
# Flags HTTP requests carrying very long Base64-like character runs in the URI or
# request body. Such payloads may be crafted to exercise the aws-sdk-cpp Base64
# decoder out-of-bounds write. High false-positive potential on normal file uploads.
alert http any any -> $HOME_NET any (msg:"CVE-2026-19642 potential Base64 decoder OOB probe in URI"; flow:to_server,established; content:"="; http.uri; pcre:"/(?:[A-Za-z0-9+\/]{256,}={0,2})/"; sid:202619642; rev:1; metadata:cve CVE-2026-19642;)

alert http any any -> $HOME_NET any (msg:"CVE-2026-19642 potential Base64 decoder OOB probe in request body"; flow:to_server,established; http.request_body; pcre:"/(?:[A-Za-z0-9+\/]{512,}={0,2})/"; sid:202619643; rev:1; metadata:cve CVE-2026-19642;)

Elastic Detection

// Elastic EQL — Hunts for application crash events that reference aws-sdk-cpp
// or generic heap-corruption/access-violation language. Tune the index pattern
// to Windows Event Log (winlogbeat) or application logs in your environment.
any where
  message like "*aws-sdk-cpp*" and
  ( message like "*Access violation*" or
    message like "*heap corruption*" or
    message like "*faulting module*" or
    event.code in ("1000", "1001") )

Splunk SPL Query

# (1) Host-side: hunt for Application Error events plausibly tied to the SDK.
index=windows sourcetype=WinEventLog:Application EventCode=1000
| rex field=Message "faulting module name:\s*(?<fault_mod>[^,]+)"
| eval cve="CVE-2026-19642"
| where fault_mod LIKE "%aws%" OR Message LIKE "%aws-sdk-cpp%"
| stats count by host, fault_mod, source, _time

# (2) Network-side: locate unusually long Base64 runs in web requests.
index=proxy OR index=web
| regex _raw="(?:[A-Za-z0-9+\/]{512,}={0,2})"
| stats count by src_ip, uri, http_method, status, user

Wazuh OSSEC Rule

<!-- Local Wazuh rule: CVE-2026-19642 crash/heap-corruption indicator.
     Add to /var/ossec/etc/rules/local_rules.xml and restart wazuh-manager. -->
<group name="cve-2026-19642,">
  <rule id="100230" level="12">
    <match>Application Error|faulting module|Segmentation fault|heap corruption|Access violation</match>
    <description>CVE-2026-19642 - possible aws-sdk-cpp Base64 decoder out-of-bounds write crash indicator</description>
    <group>pci_dss_11.4,gdpr_IV_35.7.d,</group>
    <mitre>
      <id>T1499.004</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

1. Immediate mitigations:

   • Upgrade aws-sdk-cpp to version 1.11.862 or later. This is the only remediation stated in the NVD description. Because Patch Confidence is 0/4 (no independent patch evidence from tracked sources), verify the exact SDK version resolved in your build toolchain (CMake, vcpkg, Conan, or direct git checkout) before declaring the fix applied.
   • Enforce application-level input validation on any data destined for Base64 decoding: reject non-canonical padding, enforce strict character-set checks, and cap the maximum accepted encoded length.
   • Run affected services with OS-level memory protections enabled (ASLR, DEP/W^X) and under a least-privilege service account to reduce the consequence of a crash or corruption.

2. Patch / upgrade steps:

   • Update the dependency constraint in all build manifests to aws-sdk-cpp >= 1.11.862.
   • Rebuild and redeploy all statically linked binaries; dynamically linked services must update the shared library and restart the affected processes.
   • After upgrade, run a targeted fuzzing pass on components that decode remote Base64 input, focusing on padding and length edge cases, to confirm the fix.

3. Long-term hardening:

   • Integrate Software Composition Analysis (SCA) into the CI/CD pipeline so that builds fail automatically when a vulnerable aws-sdk-cpp version is detected.
   • Continuously monitor EPSS and CISA KEV for escalation of exploitation evidence; revisit detection rules if a public PoC appears.
   • Assume that any library accepting remote input is a future exploitation target — apply fuzzing and memory-sanitizer builds (e.g., AddressSanitizer) to all SDK-touching components in test pipelines.

References

1. NVD — CVE-2026-19642 detail: https://nvd.nist.gov/vuln/detail/CVE-2026-19642
2. OSV — CVE-2026-19642 vulnerability entry: https://osv.dev/vulnerability/CVE-2026-19642
3. Upstream repository — aws-sdk-cpp (release 1.11.862): https://github.com/aws/aws-sdk-cpp
4. MITRE ATT&CK — T1499.004 Application or System Exploitation: https://attack.mitre.org/techniques/T1499/004/
5. CISA KEV — no entry for CVE-2026-19642 as of this writing; no known threat-actor campaigns or exploit-in-the-wild evidence have been publicly reported.