CVE-2025-12829 - Integer Overflow issue in Amazon Ion-C

unknownCVE-2025-12829

Bulletin ID: AWS-2025-027 Scope: Amazon Content Type: Important (requires attention) Publication Date: 2025/11/7 10:15 AM PDT Description: Amazon's Ion-C is a library for the C language that is used to read and write Amazon Ion data. We Identified CVE-2025-12829, which describes an uninitialized stack read issue in Ion-C versions < v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. Impacted versions: < v1.1.4

CSIRTS triage

vendor: Amazon product: Ion-C Information disclosureaffected: < v1.1.4

What: An uninitialized stack read issue may expose sensitive data in memory.
Who is affected: Users of Ion-C versions earlier than 1.1.4.
Urgency: Remediation is important to prevent sensitive data exposure.
Action: Upgrade to version 1.1.4 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Ion-C

Get an email when a new Ion-C advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-06-05
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/aws-2025-027/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2025-128290.15% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-12829	coverage & exploitation status	NVD · CVE.org

Recent advisories for - Integer Overflow

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-80186: A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stac…nvd · 2026-08-25
unknownCVE-2026-79231: Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to …nvd · 2026-08-25
unknownCVE-2026-79216: Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who…nvd · 2026-08-25
unknownCVE-2026-79142: Buffer overflow in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remot…nvd · 2026-08-25
unknownCVE-2026-79130: Buffer overflow in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to …nvd · 2026-08-25
unknownCVE-2026-78948: Buffer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to …nvd · 2026-08-25