What is CVE-2026-119148?

CVE-2026-119148 is a medium-severity vulnerability in AWS Aws-Nitro-Enclaves-Sdk-C, classified under CWE-807. CVSS score: 6.5/10. Published 2026-10-30.

How severe is CVE-2026-119148?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in AWS Aws-Nitro-Enclaves-Sdk-C

CVE-2026-119148

Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate this issue, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.

Published 2026-10-30 · last modified 2026-10-30.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

AWS Aws-Nitro-Enclaves-Sdk-C

Weakness classification (CWE)

CWE-807

References

ff89ba41-3aa1-4d27-914a-91399e9639e5 (release-notes, patch)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (third-party-advisory)

Frequently asked questions

What is CVE-2026-119148?: CVE-2026-119148 is a medium-severity vulnerability in AWS Aws-Nitro-Enclaves-Sdk-C, classified under CWE-807. CVSS score: 6.5/10. Published 2026-10-30.
How severe is CVE-2026-119148?: Medium severity. CVSS v3 base score is 6.5 out of 10.