CVE-2026-19642

CVE-2026-19642 is a heap memory corruption vulnerability in the aws-sdk-cpp Base64 decoder (fixed in version 1.11.862). The root cause is a bounds miscalculation during decoded length estimation—likely an integer overflow or padding validation failure—that allows specially-crafted Base64 input to write past allocated buffer boundaries. This is not a novel failure mode. The same genetic pattern has appeared in OpenSSL, authentication libraries, and numerous frameworks over the past decade: input length computed incorrectly, output buffer allocated based on faulty arithmetic, heap corruption ensues. The real exposure lives in how applications use this decoder. AWS SDK consumers typically treat Base64 decoding as a transport convenience rather than a security boundary. Data arrives through authenticated API calls, passes through gateways and microservices, and arrives at the decoder with an implicit trust assumption that 'authenticated user' equals 'safe input.' It doesn't. Every hop between the authenticating service and the decoder is an attack surface where malicious payloads can propagate. If you're running aws-sdk-cpp, your priority is upgrading to 1.11.862. But the more important question is whether any service in your stack feeds user-controlled Base64 to a library decoder without validating length and character set bounds first. If the answer is yes—and for most organizations it is—that's your systemic gap. The decoder should never receive untrusted input without prior bounds checking. This isn't a one-off bug in aws-sdk-cpp; it's evidence that the entire ecosystem has underweighted Base64 decoding as a parsing operation requiring the same input validation as any other parser. Audit your call sites, validate before decoding, and treat the library decoder as a security boundary, not a convenience function.

Reviewed through automated stages and approved by a human before publication.