CVE-2026-119116

High

Description

A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave. To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.

SeverityHigh

CVSS7.8

Exploit probability—

ProductAws Kmstool-enclave

PublishedOct 30, 2026

First seenNov 4, 2026

Weakness typeCWE-416Use after free CWE-415CWE-415

How to fix

Update

AWS kmstool-enclave0.4.6 or later

Patches

github.com/aws/aws-nitro-enclaves-sdk-c/releases/tag/v0.4.6

Vendor advisories

aws.amazon.com/security/security-bulletins/2026-157-aws/

Affected products

Product	Affected versions	Fixed in
AWS kmstool-enclave	v < 0.4.6	0.4.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.