Vulnerability · Published Dec 17, 2025 · Assigned by AMZN
CVE-2025-14760
Medium 5.3
In plain English
A medium-severity broken cryptography in AWS SDK for C++ from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 94.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Missing cryptographic key commitment in the AWS SDK for C++ may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for C++ to version 1.11.712 or later
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AWS | AWS SDK for C++ | 1.11.712 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N