Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c
Impact
A use-after-free issue in kmstool-enclave in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application to corrupt heap memory inside a Nitro Enclave. The vulnerability is in the SetClient command handler. An application on the parent EC2 instance may be able to exploit this issue.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
AWS · AMZN
kmstool-enclave
1 range
AWS · AMZN
kmstool-enclave
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 0.4.6
custom versions
Other versions: unaffected
Original source description
A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave.
To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-119116View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
AMZN · platform conditions
Any condition may hold
Any condition may hold
Vulnerable product
cpe:2.3:a:aws:kmstool-enclave:*:*:*:*:*:*:*:*From (inclusive): 0
Before: 0.4.6
Original applicability statements
[
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:aws:kmstool-enclave:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0",
"versionEndExcluding": "0.4.6"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-119116
Observed 2026-10-30T20:23:47.707Z · upstream updated 2026-10-30T20:00:57.890Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T19:21:57.096116Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "no" }, { "name": "Technical Impact", "value": "total" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.