An out‑of‑bounds read occurs in the Base64 decoder of Amazon aws-sdk-cpp when processing malformed Base64 strings on platforms that use signed characters. The flaw allows a remote authenticated user to supply crafted input that can trigger an application crash, resulting in denial of service. The vulnerability is a classic buffer overread (CWE‑125) and does not provide direct code execution capabilities.

The issue affects all users of AWS’ aws-sdk-cpp version prior to 1.11.862 when the library is compiled on signed‑char platforms. The specific product is the AWS SDK for C++ provided by Amazon, and any application that links against this library and uses its Base64 decoder is potentially affected.

With a CVSS score of 6, the flaw is rated as medium severity. The EPSS score is currently unavailable, but the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. It requires the attacker to have authenticated access to the application and craft a specific Base64 payload to trigger the crash, so while the exploit can lead to service interruption, it is not trivially exploitable at scale.