Bouncy Castle C# CVE-2026-16000

Exploitation requires that the application use the DSTU 7624 (Kalyna) KCcmBlockCipher class directly AND encrypt messages with no associated data (empty AAD) - the exact condition under which the nonce-binding G1 block was skipped. The attacker must also have a chosen/known-plaintext encryption oracle to obtain ciphertext+tag pairs under at least two nonces (the PoC uses three empty-AAD queries) to cancel the nonce-dependent keystreams. Limiting factors that reduce real-world exposure: applications that always supply associated data, use other AEAD modes, or do not use DSTU 7624 are unaffected; the attack needs oracle access to chosen plaintexts; and only bc-csharp versions before 2.7.0 are vulnerable.

The vendor CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N) with VI:H and VC:N/VA:N correctly frames this as a high-severity, integrity-only cryptographic forgery - the DSTU 7624 (Kalyna) KCcmBlockCipher fails to bind the nonce into the CBC-MAC when no associated data is supplied, letting an attacker forge valid authentication tags. There is no CISA KEV listing and no EPSS score in the provided data, so active or widespread exploitation is unconfirmed; no standalone weaponized exploit was identified at time of analysis, though the patch commit's regression test publicly contains the exact cross-nonce XOR forgery construction, which materially lowers the research barrier. The key conflict is that the CVSS vector (AV:N/AC:L/PR:N) implies trivial remote exploitation, but it does not capture the real preconditions: the attacker needs a chosen/known-plaintext encryption oracle, the application must call KCcmBlockCipher directly with empty associated data, and DSTU 7624 is a niche Ukrainian national cipher rarely used outside Ukraine-specific deployments. Net assessment: a genuine, patch-worthy integrity flaw that is critical for the small population of affected applications, but a lower real-world priority than the raw 8.7 suggests because the exploitable configuration is narrow. A fix is available (bc-csharp 2.7.0), so remediation is simply upgrading.

An attacker who can submit chosen plaintexts to a service that encrypts them with KCcmBlockCipher and supplies no associated data collects a few ciphertext+tag pairs across different nonces, then XORs them to construct a valid ciphertext and authentication tag for a message/nonce that was never actually encrypted - e.g., forging an authenticated record or command the receiver accepts as genuine. No standalone public exploit was identified, but the patch commit's regression test publicly demonstrates the precise three-query forgery algorithm.