CVE-2026-119116

Name of the Vulnerable Software and Affected Versions aws-nitro-enclaves-sdk-c versions prior to 0.4.6

Description A use-after-free and double-free issue exists in the SetClient command handler of the kmstool-enclave sample application. This flaw allows an application running on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave, potentially leading to arbitrary code execution within the enclave. Use-after-free occurs when a program continues to use a pointer after it has been freed, and double-free occurs when the same memory address is freed twice, both of which can lead to memory corruption.

Recommendations Rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.