PT-2025-45475 · Amazon · Amazon Ion-C

Published 2025-11-07 · Updated 2025-11-08 · CVE-2025-12829

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Amazon Ion-C versions prior to 1.1.4

Description An uninitialized stack read issue exists that may allow an attacker to craft data and serialize it to Ion text. This could expose sensitive data in memory through UTF-8 escape sequences.

Recommendations Upgrade to version 1.1.4.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2025-12829

GHSA-7MGF-6X73-5H7R

Affected Products

Amazon Ion-C

References · 7

• https://github.com/amazon-ion/ion-c/releases/tag/v1.1.4 · Patch
• https://github.com/amazon-ion/ion-c/security/advisories/GHSA-7mgf-6x73-5h7r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12829 · Security Note
• https://aws.amazon.com/security/security-bulletins/AWS-2025-027 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12829 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1986969497148739829 · Twitter Post
• https://twitter.com/CVEnew/status/1986861768778391822 · Twitter Post