Bouncy Castle C# CVE-2026-63569

Exploitation requires that the target application call DHAgreement.CalculateAgreement directly using the MTI/A0 two-pass Diffie-Hellman flow (higher-level protocol wrappers are not affected). The attacker must be a protocol peer or an on-path attacker able to inject a crafted 'message' or public-key value. For authentication defeat (making the local party compute an attacker-known value), on-path peer interaction suffices. For private-key disclosure, the local party must reuse a STATIC DH private key; the attacker then learns the key modulo the small factors of p-1, and full recovery additionally requires a group (parameter p) whose p-1 has many small prime factors. Limiting factors that reduce realistic risk: the narrow API surface (direct DHAgreement callers only), the requirement for static/reused keys rather than ephemeral keys, and the dependence on weak group parameters for complete key recovery.

This is a genuine high-priority cryptographic flaw, but its real-world blast radius is narrower than the 9.1 score suggests. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H) signals a network-reachable, unauthenticated issue with high confidentiality and integrity impact - consistent with recovery of the local static private key and defeat of MTI/A0 key authentication. However, the AT:P (Attack Requirements: Present) metric is doing significant work and must not be ignored: exploitation requires the attacker to be a protocol peer or on-path, and full key recovery additionally requires that the victim reuse a static DH private key and operate in a group whose p-1 has many small factors. A patch is confirmed available from the vendor. No EPSS score was provided, there is no CISA KEV listing, and no public exploit (POC) was identified in the input - so exploitation status is: no public exploit identified at time of analysis. The core technique (small-subgroup confinement / invalid-curve-style key recovery via CRT) is well-understood academically, which raises the plausibility of exploitation against vulnerable deployments, but there is no evidence of active exploitation. Net assessment: real cryptographic priority for the specific population that calls DHAgreement directly with reused keys, but not a mass-exploitation 'patch tonight everywhere' event.

An application uses bc-csharp's DHAgreement (MTI/A0 two-pass Diffie-Hellman) with a static/reused DH private key. A malicious peer or on-path attacker submits a crafted out-of-range or small-order ephemeral value, which the victim raises to its static private key without range or subgroup-membership validation; the resulting agreed value leaks the private key modulo the small factors of p-1, enabling partial or (in groups with many small factors) full key recovery, or lets the attacker force a known shared value and defeat MTI/A0 authentication. No public exploit was identified at time of analysis.