Medium severity · published Apr 3, 2026
CVE-2026-35559
Out-of-bounds write in query processing components in Amazon Athena ODBC driver
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Out-of-bounds write in the query processing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to crash the driver by using specially crafted data that is processed by the driver during query operations.
To remediate this issue, users should upgrade to version 2.1.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Amazon Athena ODBC driver · Amazon
before 2.1.0.0 · source: vendor
AO
Athena Odbc · Amazon
before 2.1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35559
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/2026-013-aws/
Release Notes
https://docs.aws.amazon.com/athena/latest/ug/odbc-v2-driver-release-notes.html
Patch
https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Linux/AmazonAthenaODBC-2.1.0.0.rpm
Patch
https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/Intel/AmazonAthenaODBC-2.1.0.0_x86.pkg
Patch
https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/arm/AmazonAthenaODBC-2.1.0.0_arm.pkg
Patch
https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Windows/AmazonAthenaODBC-2.1.0.0.msi
More from Amazon Athena ODBC driver
9.8
CVE-2026-35561
Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver
7.8
CVE-2026-35558
Improper neutralization of special elements in authentication components in Amazon Athena ODBC driver
7.8
CVE-2026-5485
OS command injection in Amazon Athena ODBC driver on Linux
7.5
CVE-2026-35562
Allocation of resources without limits in parsing components in Amazon Athena ODBC driver
5.9
CVE-2026-35560
Improper certificate validation in identity provider connection components in Amazon Athena ODBC driver