---
id: CVE-2025-12815
title: >-
  An ownership verification issue in the Virtual Desktop preview page in the
  Research and Engineering Studio (RES) on AWS before version 2025.09 may allow
  an authenticated remote user to view another user's active desktop session
  metadata,…
summary: >-
  An ownership verification issue in the Virtual Desktop preview page in the
  Research and Engineering Studio (RES) on AWS before version 2025.09 may allow
  an authenticated remote user to view another user's active desktop session
  metadata,…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-283
published: '2025-11-06'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T21:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-12815'
references:
  - url: 'https://aws.amazon.com/security/security-bulletins/AWS-2025-026/'
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
  - url: 'https://github.com/aws/res/releases/tag/2025.09'
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
  - url: 'https://github.com/aws/res/security/advisories/GHSA-x3cx-g8g9-75hv'
    label: ff89ba41-3aa1-4d27-914a-91399e9639e5
tags:
  - nvd
epss: 0.00312
epssPercentile: 0.22036
ingestedAt: '2026-10-07T21:54:14.964Z'
---

## Overview

An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote user to view another user's active desktop session metadata, including periodical desktop preview screenshots. 

To mitigate this issue, users should upgrade to version 2025.09 or above.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.