Use-After-Free and Double-Free Vulnerability in AWS Nitro Enclaves SDK

CVE-2026-119116

What is CVE-2026-119116?

A use-after-free and double-free vulnerability exists in the SetClient command handler of the kmstool-enclave sample application within the AWS Nitro Enclaves SDK prior to version 0.4.6. This flaw can potentially allow an application running on the parent EC2 instance to exploit the vulnerability, leading to heap memory corruption within the Nitro Enclave. This scenario may facilitate arbitrary code execution inside the enclave, creating significant security risks for applications relying on this technology. To mitigate this vulnerability, users are advised to rebuild any enclave images that utilize kmstool-enclave against the updated aws-nitro-enclaves-sdk-c version 0.4.6.

References