CVE-2026-3336: PKCS7_verify Certificate Chain Validation Bypass in AWS-LC

CVE-2026-3336 is a vulnerability in PKCS7_verify Certificate Chain Validation Bypass in AWS-LC, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.74% probability of exploitation activity in the next 30 days, higher than 55% of all scored vulnerabilities. Microsoft published it on 5 March 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Mariner).

Key facts

CVE ID

CVE-2026-3336

Severity

High CVSS 7.5

Microsoft severity

Important

Exploited in the wild

No

Publicly disclosed

No

Weakness

CWE-295

EPSS

0.74% (percentile 55%)

CISA KEV

Not listed

Released

5 March 2026

Last updated

6 March 2026

Patch Tuesday

March 2026 Patch Tuesday

Product families

Mariner

CVSS score and vector

Microsoft scores CVE-2026-3336 at 7.5 (temporal 7.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products (1)

Mariner

NIST NVD data

NVD status

Analyzed

NVD CVSS

7.5 (HIGH)

NVD weakness

CWE-295

Published to NVD

2 March 2026

NVD last modified

11 March 2026

Affected configurations (CPE)

References

• https://aws.amazon.com/security/security-bulletins/2026-005-AWS/ (Vendor Advisory)
• https://github.com/aws/aws-lc/releases/tag/v1.69.0 (Release Notes)
• https://github.com/aws/aws-lc/security/advisories/GHSA-cfwj-9wp5-wqvp (Vendor Advisory)

Revision history

Related vulnerabilities

More from the March 2026 Patch Tuesday

• CVE-2025-69720: The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c. (Critical, CVSS 9.8)
• CVE-2026-3381: Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib (Critical, CVSS 9.8)
• CVE-2026-4176: Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib (Critical, CVSS 9.8)
• CVE-2026-33186: gRPC-Go has an authorization bypass via missing leading slash in :path (High, CVSS 8.1)
• CVE-2026-27601: Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack (High, CVSS 7.5)
• CVE-2026-3338: PKCS7_verify Signature Validation Bypass in AWS-LC (High, CVSS 7.5)
• CVE-2026-5201: Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image (High, CVSS 7.5)
• CVE-2026-23868: Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling. The conditions needed to trigger this vulnerability are difficult but may be possible. (High, CVSS 7)
• CVE-2026-4897: Polkit: polkit: denial of service via unbounded input processing through standard input (Medium, CVSS 5.5)
• CVE-2026-33343: etcd: Nested etcd transactions bypass RBAC authorization checks (Medium, CVSS 5.4)
• CVE-2026-23865: An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2. (Medium, CVSS 5.3)
• CVE-2026-25645: Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function (Medium, CVSS 4.4)

All vulnerabilities of this release: March 2026 Patch Tuesday

Sources

• Microsoft Security Update Guide: CVE-2026-3336
• NIST NVD: CVE-2026-3336
• CVE.org record: CVE-2026-3336