What is CVE-2025-12829?

CVE-2025-12829 is a medium-severity vulnerability in Amazon Ion-C, classified under Out-of-bounds Read. CVSS score: 6.2/10. Published 2025-11-07.

How severe is CVE-2025-12829?

Medium severity. CVSS v3 base score is 6.2 out of 10.

Out-of-bounds Read in Amazon Ion-C

CVE-2025-12829

An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.

Vulnerability class: Buffer Overflow

EPSS: 0.001 (4.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Amazon Ion-c — versions 1.1.4

Weakness classification (CWE)

CWE-125 — Out-of-bounds Read

References

ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (patch)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)

Frequently asked questions

What is CVE-2025-12829?: CVE-2025-12829 is a medium-severity vulnerability in Amazon Ion-C, classified under Out-of-bounds Read. CVSS score: 6.2/10. Published 2025-11-07.
How severe is CVE-2025-12829?: Medium severity. CVSS v3 base score is 6.2 out of 10.