The vulnerability permits an actor who controls the execution environment to supply an invalid or non‑AWS region value, causing the SDK to route API requests to a non‑existent or external host. This may lead to unintended network traffic, potential data leakage, or denial of service to the intended AWS services. The flaw is a classic input validation error (CWE‑20).

The affected products are the AWS SDK for .NET, versions 4.0.0 through 4.0.3.2. The issue was addressed in version 4.0.3.3. Applications that reference the SDK within this vulnerable range and allow region values to be set from untrusted sources are at risk.

The CVSS score is 3.7, indicating low severity, and the EPSS score is below 1 %, reflecting a very low likelihood of exploitation. Because the flaw requires access to the application’s environment to set the region field, remote exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. The overall risk is modest, but upgrading immediately eliminates the weakness.