What’s Vulnerable › Vulnerabilities

CVE-2025-0500: Issue affecting Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV clients

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-15 · updated 2026-06-17
• Weakness: CWE-295

Description

An issue in the native clients for Amazon WorkSpaces (when running Amazon DCV protocol), Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle.

Affected products

• Amazon AppStream 2.0 Client: from 1.1.1025 before 1.1.1332 — fixed in 1.1.1332
• Amazon DCV Client: before 2023.1.6703; from 2020.2.7459 before 2023.1.9127; from 2020.2.2078 before 2023.1.6703 — fixed in 2023.1.6703, 2023.1.9127
• Amazon WorkSpaces Client: from 5.0.0 before 5.21.0; from 2023.0 before 2024.2; from 5.5.0 before 5.21.0 — fixed in 2024.2, 5.21.0

How to fix

Upgrade to a fixed version: Amazon AppStream 2.0 Client 1.1.1332; Amazon DCV Client 2023.1.6703, 2023.1.9127; Amazon WorkSpaces Client 2024.2, 5.21.0. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/AWS-2025-001/
• https://docs.aws.amazon.com/appstream2/latest/developerguide/client-release-versions.html
• https://docs.aws.amazon.com/dcv/latest/adminguide/doc-history-release-notes.html#dcv-2023-1-16388jul
• https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-linux-client.html#linux-release-notes
• https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-osx-client.html#osx-release-notes
• https://docs.aws.amazon.com/workspaces/latest/userguide/amazon-workspaces-windows-client.html#windows-release-notes

Get alerted when CVE-2025-0500 or the next vulnerability affects your stack