6.9
/ 10
MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be exposed through UTF-8 escape sequences. To mitigate this issue, users should upgrade to version v1.1.4.
Basic Information
ID
CVE-2025-12829
Source
AMZN
Published
Nov 7, 2025 at 18:04
Modified
Nov 7, 2025 at 18:13
Affected Product
Vendor
Amazon
Product
Ion-C
Version
1.1.4