Description (CNA)
An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Amazon / Ion-C | unaffected 1.1.4 |
CWE
CWE-125
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-027/
- https://github.com/amazon-ion/ion-c/releases/tag/v1.1.4
- https://github.com/amazon-ion/ion-c/security/advisories/GHSA-7mgf-6x73-5h7r
ADP enrichment
No English description supplied.
No references supplied.