CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2025-12829 - Integer Overflow issue in Amazon Ion-C

unknownCVE-2025-12829
Bulletin ID: AWS-2025-027 Scope: Amazon Content Type: Important (requires attention) Publication Date: 2025/11/7 10:15 AM PDT Description: Amazon's Ion-C is a library for the C language that is used to read and write Amazon Ion data. We Identified CVE-2025-12829, which describes an uninitialized stack read issue in Ion-C versions < v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. Impacted versions: < v1.1.4

CSIRTS triage

vendor: Amazonproduct: Ion-CInformation disclosureaffected: < v1.1.4
What
An uninitialized stack read issue may expose sensitive data in memory.
Who is affected
Users of Ion-C versions earlier than 1.1.4.
Urgency
Remediation is important to prevent sensitive data exposure.
Action
Upgrade to version 1.1.4 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Ion-C

Get an email when a new Ion-C advisory drops — max one per day, one-click unsubscribe.

Details

Source
AWS Security Bulletins (INTL · vendor-psirt · site)
Severity
unknown
Published
2026-06-05
Exploitation
Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/aws-2025-027/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2025-12829coverage & exploitation statusNVD · CVE.org

Recent advisories for - Integer Overflow

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from AWS Security Bulletins