CVE-2025-12829

Descripción

An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://aws.amazon.com/security/security-bulletins/AWS-2025-027/ vendor-advisory
• https://github.com/amazon-ion/ion-c/releases/tag/v1.1.4 patch
• https://github.com/amazon-ion/ion-c/security/advisories/GHSA-7mgf-6x73-5h7r vendor-advisory