Amazon Ion-C

• CVE-2026-84851 High 7.5 Uncontrolled recursion in the Ion reader in Amazon Ion-C before 1.1.6 0.6%
• CVE-2025-12829 Medium 6.2 An uninitialized stack read issue exists in Amazon Ion-C versions <v1.1.4 that may allow a threat actor to craft data and serialize it to Ion text in such a way that sensitive data in memory could be 0.2%