Bouncy Castle CVE-2026-71887

Exploitation is limited to the high-level OpenPGP API (org.bouncycastle.openpgp.api, e.g. OpenPGPCertificate and OpenPGPDocumentSignature.isValid()); the low-level PGPSignature/PGPPublicKeyRing API performs no binding checks by design and is unaffected. The attacker must possess the victim's public signing subkey (public material) and an existing message genuinely signed by that subkey, then construct a Subkey Binding signature that omits both the Key Flags subpacket and the embedded Primary Key Binding (cross-certification) signature. The flaw only yields a harmful result when the relying party pins trust on the subkey's fingerprint or key ID while deriving the signer identity from the enclosing, attacker-controlled certificate's self-asserted User IDs. Key limiting factors: no new signature can be forged and no private key is recovered - only a signature the subkey actually made can be misattributed; and version 1.86 stops a subkey inheriting the primary key's flags, so the cross-certification check is enforced.

The vendor-supplied CVSS 4.0 base score is 8.2 (High), driven entirely by integrity impact (VI:H) with no confidentiality or availability effect (VC:N/VA:N) and no scope change to subsequent systems (SC:N/SI:N/SA:N). The vector is network-reachable with low complexity and no required privileges (AV:N/AC:L/PR:N/UI:N), but it carries AT:P (attack requirement present), which correctly reflects that exploitation is not self-contained: the attacker must already possess a genuine message signed by the victim's signing subkey plus that subkey's public material. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. This CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis and no confirmed active exploitation. The practical risk is narrower than 8.2 implies: the flaw only affects the high-level OpenPGP API (org.bouncycastle.openpgp.api) and only produces a harmful outcome for relying parties that pin trust on a subkey fingerprint/key ID while taking identity from the enclosing certificate; the low-level PGPSignature/PGPPublicKeyRing API is unaffected by design. It is signature misattribution (a genuine signature reported under an attacker-chosen identity), not key recovery or forgery of a new signature. Net: a legitimate, well-reasoned high-severity cryptographic verification defect worth prioritizing for users of the high-level OpenPGP certificate API, but absent EPSS/KEV/POC signals it reads as a correctness and RFC-9580-compliance fix rather than an imminent mass-exploitation threat.

An attacker takes a victim's public signing subkey (public material) and binds it under their own primary key using a Subkey Binding signature they craft without a Key Flags subpacket and without the embedded Primary Key Binding (cross-certification) signature they could not legitimately produce. When a relying party uses Bouncy Castle's high-level OpenPGP API to verify one of the victim's genuinely signed messages against this attacker certificate, OpenPGPDocumentSignature.isValid() returns true and reports the attacker's identity as the signer. No public exploit code is referenced, but the technique requires only standard OpenPGP packet manipulation plus an existing genuine signature, consistent with the AV:N/AC:L/AT:P vector.