CVE-2026-3338 Security Details

CVE ID

CVE-2026-3338

CWE

CWE-347

CVE Description

Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0.

Published

Mar 3, 2026

CVSS Score & Severity

8.7High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS Score

0.014%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Affected Ecosystems

affected

Source

National Vulnerability Database

References

https://github.com/aws/aws-lc-rs/security/advisories/GHSA-hfpc-8r3f-gw53PROJECT

https://github.com/aws/aws-lc/security/advisories/GHSA-jchq-39cv-q4wjPROJECT