An out-of-bounds write occurs in the streaming decoder component of the aws-c-event-stream library before version 0.6.0. A third party operating a server can send crafted event-stream messages that trigger memory corruption in any client application that processes those messages, which may result in arbitrary code execution and compromise confidentiality, integrity, and availability.

The vulnerability affects the aws-c-event-stream library from AWS, impacting all releases before 0.6.0. Any client application or service that consumes event-stream data from external sources and links against this library is at risk, including integrations with AWS EventBridge, custom event brokers, or any service that processes event-stream traffic on a machine running a vulnerable library.

The formal CVSS rating of 7.7 signals a high severity level, and the issue is not listed in the CISA KEV catalog. Because the flaw is triggered by data received from a remote server, the attack vector is remote: an adversary that can send malicious event-stream payloads can exploit the buffer overflow. The EPSS score is < 1%, indicating a very low but non-zero exploitation probability. The potential for arbitrary code execution makes the risk significant for systems exposed to untrusted event streams.