CVE-2026-5190 AWS C Event Stream Streaming Decoder Stack Buffer Overflow
A stack buffer overflow in the AWS C event stream decoder allows remote attackers to execute arbitrary code on client applications processing crafted messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-5190?
CVE-2026-5190 is a high-severity memory corruption vulnerability in aws-c-event-stream, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leading to arbitrary code execution on a client application that processes crafted event-stream messages.
To remediate this issue, users should upgrade to version 0.6.0 or later.
Weakness: CWE-787
Which versions are affected by CVE-2026-5190?
Linux distribution packages (2)
aws-c-event-stream openSUSE:Leap 16.0 | All versions | 0.4.2-bp160.2.1 |
aws-c-event-stream openSUSE:Tumbleweed | All versions | 0.7.0-1.1 |
How do I fix CVE-2026-5190?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-5190 being exploited?
There is no known exploitation of CVE-2026-5190 in the wild and no public exploit code.
Sources
Also known as GHSA-xvjw-fjq5-68hf, openSUSE-SU-2026:10512-1, openSUSE-SU-2026:20477-1.