An out‑of‑bounds write was discovered in the streaming decoder component of the aws‑c‑event‑stream library in versions older than 0.6.0. The flaw can be triggered by specially crafted event‑stream messages, allowing a threat actor who controls a server to corrupt the memory of any client application that processes those messages. The resulting memory corruption can lead to arbitrary code execution, exposing the client to compromise of confidentiality, integrity, and availability.

The vulnerability affects the aws‑c‑event‑stream library from AWS, impacting all releases before 0.6.0. Any client application or service that consumes event‑stream data from external sources and links against this library is at risk, including integrations with AWS EventBridge, custom event brokers, or any service that processes event‑stream traffic on a machine running a vulnerable library.

The formal CVSS rating of 7.7 signals a high severity level, and the issue is not listed in the CISA known exploited vulnerabilities catalog. Because the flaw is triggered by data received from a remote server, the attack vector is remote: an adversary that can send malicious event‑stream payloads can exploit the buffer overflow. No exploit probability score is publicly available, but the potential for arbitrary code execution makes the risk significant for systems exposed to untrusted event streams.