CVE-2025-12829: Medium severity Amazon Ion-C vulnerability
An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon Ion-Cto a version that resolves this vulnerability.Fixed in v1.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12829?
CVE-2025-12829 is considered a medium severity vulnerability due to the potential exposure of sensitive data.
How do I fix CVE-2025-12829?
To mitigate CVE-2025-12829, users should upgrade to Amazon Ion-C version v1.1.4 or later.
What kind of data could be exposed due to CVE-2025-12829?
CVE-2025-12829 may expose sensitive data in memory through crafted Ion text serialized with UTF-8 escape sequences.
Which versions of Amazon Ion-C are affected by CVE-2025-12829?
CVE-2025-12829 affects all versions of Amazon Ion-C prior to v1.1.4.
Who is responsible for addressing CVE-2025-12829?
Users of Amazon Ion-C are responsible for addressing CVE-2025-12829 by upgrading to the fixed version.