PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35559 Amazon CVE debrief

The CVE record for CVE-2026-35559 was published on 2026-04-03T21:17:11.900Z and has not been modified since then. The NVD entry is currently Analyzed. This out-of-bounds write vulnerability in the Amazon Athena ODBC driver before version 2.1.0.0 might allow a threat actor to crash the driver by using specially crafted data during query operations. Users of Amazon Athena ODBC driver versions before 2.1.0.0 should upgrade to prevent potential driver crashes. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity.

Vendor
Amazon
Product
Amazon Athena ODBC driver
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-03
Original CVE updated
2026-07-24
Advisory published
2026-04-03
Advisory updated
2026-07-24

Who should care

Users of Amazon Athena ODBC driver versions before 2.1.0.0 should upgrade to prevent potential driver crashes. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update affected systems and applications. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity, indicating high priority for remediation.

Technical summary

The Amazon Athena ODBC driver before version 2.1.0.0 has an out-of-bounds write vulnerability in its query processing components. This might allow a threat actor to crash the driver by using specially crafted data during query operations. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. Users of Amazon Athena ODBC driver versions before 2.1.0.0 should upgrade to version 2.1.0.0 or later to prevent potential driver crashes.

Defensive priority

High priority should be given to upgrading the Amazon Athena ODBC driver to version 2.1.0.0 or later. This is due to the HIGH severity of the vulnerability and the potential for a threat actor to crash the driver using specially crafted data during query operations.

Recommended defensive actions

  • Upgrade to Amazon Athena ODBC driver version 2.1.0.0 or later
  • Review and update affected systems and applications
  • Monitor for potential exploitation attempts
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is based on official CVE and NVD records, as well as vendor advisories and release notes. The Amazon Athena ODBC driver before version 2.1.0.0 has an out-of-bounds write vulnerability in its query processing components. This might allow a threat actor to crash the driver by using specially crafted data during query operations. Evidence limits suggest that affected deployments should be verified for potential exposure. Defenders should review official advisories and CVE records for affected scope, severity, and vendor guidance.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35559 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35559

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35559 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35559

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://aws.amazon.com/security/security-bulletins/2026-013-aws/

    ff89ba41-3aa1-4d27-914a-91399e9639e5 - Vendor Advisory

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://docs.aws.amazon.com/athena/latest/ug/odbc-v2-driver-release-notes.html

    ff89ba41-3aa1-4d27-914a-91399e9639e5 - Release Notes

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Linux/AmazonAthenaODBC-2.1.0.0.rpm

    ff89ba41-3aa1-4d27-914a-91399e9639e5 - Patch, Product

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/Intel/AmazonAthenaODBC-2.1.0.0_x86.pkg

    ff89ba41-3aa1-4d27-914a-91399e9639e5 - Patch, Product

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Mac/arm/AmazonAthenaODBC-2.1.0.0_arm.pkg

    ff89ba41-3aa1-4d27-914a-91399e9639e5 - Patch, Product

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://downloads.athena.us-east-1.amazonaws.com/drivers/ODBC/v2.1.0.0/Windows/AmazonAthenaODBC-2.1.0.0.msi

    ff89ba41-3aa1-4d27-914a-91399e9639e5 - Patch, Product

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.