CVE-2025-14759

Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade Amazon S3 Encryption Client for .NET to version 3.2.0 or later.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/AWS-2025-032/
https://github.com/aws/amazon-s3-encryption-client-dotnet/releases/tag/release_2025-12-17
https://github.com/aws/amazon-s3-encryption-client-dotnet/security/advisories/GHSA-4v42-65r3-3gjx

Configurations

No configuration.

History

17 Dec 2025, 21:15

Type	Values Removed	Values Added
References		() https://github.com/aws/amazon-s3-encryption-client-dotnet/releases/tag/release_2025-12-17 - () https://github.com/aws/amazon-s3-encryption-client-dotnet/security/advisories/GHSA-4v42-65r3-3gjx -
Summary	(en) The Amazon S3 Encryption Client for .NET is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade Amazon S3 Encryption Client for .NET to version 4.0.0 or later.	(en) Missing cryptographic key commitment in the Amazon S3 Encryption Client for .NET may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade Amazon S3 Encryption Client for .NET to version 3.2.0 or later.

17 Dec 2025, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-12-17 20:15

Updated : 2025-12-18 15:07

NVD link : CVE-2025-14759

Mitre link : CVE-2025-14759

CVE.ORG link : CVE-2025-14759

JSON object : View

Products Affected

No product.

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

5.3 /10