CVE-2025-14764

CVE-2025-14764 describes a missing cryptographic key commitment in the Amazon S3 Encryption Client for Go, specifically impacting scenarios where encrypted data keys are stored in an "instruction file." This vulnerability allows an attacker with write access to an S3 bucket to introduce a new encrypted data key that decrypts to different plaintext. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-based attack with high complexity, requiring low privileges, and resulting in a high integrity impact (data manipulation). There is no confidentiality or availability impact. Currently, there is no known active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. While there is minimal community discussion and media coverage, the issue has been acknowledged by AWS.