Description
An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.
References (3)
Core 3
Core References
Various Sources vendor-advisory
https://aws.amazon.com/security/security-bulletins/AWS-2025-027/
Release Notes patch
https://github.com/amazon-ion/ion-c/releases/tag/v1.1.4
Vendor Advisory vendor-advisory
https://github.com/amazon-ion/ion-c/security/advisories/GHSA-7mgf-6x73-5h7r
Scores
CVSS v3
6.2
EPSS
0.0001
EPSS Percentile
3.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-125
Status
published
Products (1)
Amazon/Ion-C
1.1.4
Published
Nov 07, 2025
Tracked Since
Feb 18, 2026