CVE-2026-5190: AWS C Event Stream Streaming Decoder Stack Buffer Overflow
Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages.
To remediate this issue, users should upgrade to version 0.6.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
aws-c-event-streamto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5190?
CVE-2026-5190 is classified as a critical severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-5190?
To fix CVE-2026-5190, upgrade aws-c-event-stream to version 0.6.0 or later.
What causes the vulnerability in CVE-2026-5190?
CVE-2026-5190 is caused by an out-of-bounds write in the streaming decoder component of aws-c-event-stream.
Who is affected by CVE-2026-5190?
CVE-2026-5190 affects users of aws-c-event-stream versions prior to 0.6.0.
What are the potential impacts of CVE-2026-5190?
The potential impacts of CVE-2026-5190 include memory corruption and arbitrary code execution on client applications.