Dell BSAFE Crypto-J CVE-2025-26333

Exploitation requires that the target application embedding Dell BSAFE Crypto-J (affected version 7.0 per the CPE) propagates the library's generated error messages back to a remote, unauthenticated requester. The flaw is an error-handling information leak (CWE-209), so the limiting factor is whether verbose/unsanitized error output is exposed outward: applications that catch, sanitize, or log-but-not-return these errors are not practically exploitable. Because BSAFE Crypto-J is a cryptographic library rather than a standalone service, the realistic attack surface and the sensitivity of the disclosed data are determined by the integrating product's error-surfacing behavior and network exposure.

This is a high-CVSS (7.5) but low real-world-risk issue once all signals are cross-referenced. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) implies a trivially reachable, network-based, unauthenticated information-disclosure flaw with high confidentiality impact and no integrity or availability impact - the C:H rating is what drives the 7.5 score. However, exploitation probability is very low: EPSS is only 0.04% (13th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code was identified in the provided intelligence. The CWE-209 nature (error message exposing environment/associated data) means the C:H rating is likely generous relative to practical impact - leaked error-message content is situational and does not equal full data compromise, so the real-world severity is probably lower than the raw score suggests. One caveat to verify: the description says 'A remote attacker could potentially exploit this' and the CVSS marks PR:N, yet BSAFE Crypto-J is a Java cryptographic library (not a standalone network service), so network reachability and the sensitivity of leaked data depend entirely on how the embedding application surfaces error messages - the AV:N/PR:N rating should be validated against the actual integrating application. No SSVC decision data was provided in the input. Net: low operational priority absent evidence of exploitation.

An attacker interacting over the network with an application that embeds Dell BSAFE Crypto-J submits malformed or unexpected cryptographic input to trigger an error condition. The resulting verbose error message returns sensitive environment or associated data (e.g., configuration, internal state, or cryptographic context) to the attacker, aiding reconnaissance or further attacks. No public proof-of-concept was identified at the time of analysis.