CVE-2025-12829

Beschreibung

An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://aws.amazon.com/security/security-bulletins/AWS-2025-027/ vendor-advisory
• https://github.com/amazon-ion/ion-c/releases/tag/v1.1.4 patch
• https://github.com/amazon-ion/ion-c/security/advisories/GHSA-7mgf-6x73-5h7r vendor-advisory