Bouncy Castle Java CVE-2026-12803

Exploitation requires all three of the following conditions simultaneously: (1) the application uses KCCMBlockCipher specifically - this flaw does not affect CCMBlockCipher, GCMBlockCipher, or any other Bouncy Castle AEAD mode; (2) encryption operations are performed with absent or zero-length AAD - any non-empty AAD triggers G1 processing and prevents the attack; (3) the attacker has chosen-plaintext oracle access - the ability to submit at least three arbitrary plaintexts to the encryption function and receive the corresponding ciphertext-plus-tag outputs. Factors that limit exploitation include: DSTU 7624 is primarily required in Ukrainian cryptographic standards contexts, confining the realistic at-risk population to compliant infrastructure in that regulatory domain; the attack requires an active, interactive encryption oracle rather than passive traffic observation; no automated exploitation framework for this class of AEAD forgery is publicly known; and the vulnerability carries no confidentiality impact, so passive eavesdropping alone cannot exploit it. No special conditions apply beyond the three prerequisites above: no default-configuration caveat, but also no universal network reachability without them.

The provided CVSS 4.0 score of 8.7 with AC:L and AT:N likely overstates real-world risk by treating exploitation as straightforward and requiring no attack prerequisites. In practice, the cross-nonce forgery requires access to a chosen-plaintext encryption oracle operating specifically under KCCMBlockCipher without AAD - a meaningful prerequisite limiting exposure to applications that expose encryption functionality to untrusted callers, use DSTU 7624 specifically, and operate without associated data. DSTU 7624 is primarily mandated in Ukrainian standards-compliant cryptographic infrastructure and is not a globally dominant cipher choice, substantially narrowing the affected population. No EPSS data was provided for quantitative exploitation probability comparison, and absence from CISA KEV indicates no confirmed in-the-wild exploitation at time of analysis. The integrity-only impact (VI:H, no confidentiality) confirms this is an authentication bypass and forgery risk rather than a data exfiltration vulnerability - the 'Information Disclosure' tag in the source data conflicts with the CVSS impact metrics and appears to be erroneous metadata. For deployments actually using KCCMBlockCipher in an adversarially-accessible context without AAD, the integrity risk is severe; for all other Bouncy Castle users, effective risk is negligible.

An attacker interacting with a service that exposes a KCCMBlockCipher encryption oracle (such as a signing or token-generation API) without any AAD submits three crafted encryption requests: enc(zeros, N1), enc(zeros, N2), and enc(target_plaintext, N2), all with empty AAD. Because the MAC is nonce-independent under the vulnerable code, the attacker XOR-combines the resulting ciphertext blocks and tags to cancel the nonce-2 keystream, producing a forged (ciphertext, tag) pair that the decryptor accepts as valid under nonce N1 - a nonce the attacker never used as an encryption input. The regression test CCMModeNonceBindingTest added in the fix commit implements this exact technique and constitutes a functional demonstration of the attack.