What is the CVSS score of EUVD-2026-91218?

EUVD-2026-91218 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.5%.

How to fix or mitigate EUVD-2026-91218?

Within 24 hours, inventory all .NET applications and services that reference the Bouncy Castle C# (bc-csharp) NuGet package, identify any versions before 2.7.0, and flag those that directly construct IesEngine with AES-CBC and PKCS#7 padding under a static key pair. Within 7 days, apply the vendor-released patch by upgrading affected components to Bouncy Castle C# 2.7.0 or later, run compatibility and cryptographic regression tests, and where immediate upgrade is not possible, disable or isolate the affected IES/ECIES decryption path, switch to stream-mode IES or standard ephemeral ECIES usage if feasible, and monitor for repeated decryption failures. Within 30 days, confirm all production and non-production instances are upgraded to 2.7.0 or later, review application designs to eliminate static-key padded-CBC IES patterns, update secure coding standards and dependency scanning to prevent reintroduction, and document risk acceptance for any residual exceptions.

Bouncy Castle C# EUVD-2026-91218

Q: Which versions of Bouncy Castle C# are affected by EUVD-2026-91218?

Bouncy Castle C# (bc-csharp) versions before 2.7.0 contain a high-severity decryption flaw that, in a non-default IES/ECIES configuration using AES-CBC with PKCS#7 padding and a static key pair,…. A patch is available.

| CVE-2026-63567 HIGH

Observable Discrepancy (CWE-203)

2026-10-02 bcorg

GHSA-6w4x-4wpp-m6r4

Information Disclosure Oracle Bc Csharp Legion Of The Bouncy Castle Inc

8.2

CVSS 4.0 · Vendor: bcorg

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Capture target IES/ECIES ciphertext
Delivery

Submit modified ciphertexts to decryption oracle
Exploit

Distinguish padding-error vs MAC-error response
Execution

Run adaptive CBC padding-oracle recovery
Impact

Reconstruct plaintext

Vulnerability Assessment

Weakness	CWE CWE-203 ASVS 5.0 V6 - Authentication Timing-safe comparisons
Exploitation Conditions	Exploitable ONLY when the application constructs IesEngine directly with a padded block cipher such as AES in CBC mode with PKCS#7 padding; the default/stream-mode IES (and standard ephemeral ECIES usage) is explicitly NOT affected. The attacker must (1) have captured a valid IES/ECIES ciphertext and (2) be able to repeatedly submit modified ciphertexts for decryption under the same key pair and observe distinguishable outcomes - i.e., the application must expose a decryption oracle whose padding-failure response differs from its MAC-failure response. These requirements (non-default block-mode construction plus an exposed, response-distinguishable decryption oracle under a static key pair) are the primary limiting factors; applications that do not offer decryption-on-demand or that use stream mode are not at risk.
Impact	This is a genuine cryptographic weakness (CWE-203, observable discrepancy) but with meaningful real-world constraints that make it lower priority than its 8.2 CVSS/4.0 score suggests in most deployments. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H) shows a network-reachable, unauthenticated confidentiality-only impact, with AT:P correctly capturing that a precondition must hold - the attacker needs a captured IES/ECIES ciphertext AND repeated access to a decryption oracle under the same key pair, which is the classic adaptive chosen-ciphertext setup. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active exploitation or weaponization; exploitation status is best characterized as no public exploit identified at time of analysis. The signals are internally consistent (network vector matches a padding-oracle service), but the dominant risk limiter is NOT in the raw CVSS: the flaw only affects applications that construct IesEngine directly with a padded block cipher (e.g., AES-CBC/PKCS#7), while the standard stream-mode ECIES usage is unaffected. Net: a real, patch-worthy library bug for the subset of applications using the vulnerable configuration, but not a broad emergency - treat as elevated for teams that explicitly use block-mode IES as a decryption service, and routine-patch otherwise.
Exploit ScenarioDerived	An application exposes a service that decrypts IES/ECIES ciphertexts built on AES-CBC with PKCS#7 padding under a fixed key pair. A remote attacker who has captured a target ciphertext submits a stream of modified variants and distinguishes padding-failure responses (different error message, MAC not computed) from MAC-failure responses, using this oracle to recover the plaintext byte-by-byte via a classic CBC padding-oracle attack. No POC was provided in the input, and no authentication is indicated by the CVSS vector (PR:N).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 02, 2026

Observable padding discrepancy in the IES/ECIES decryption path of Bouncy Castle C

(bc-csharp) before 2.7.0 lets an unauthenticated remote attacker who has captured a valid ciphertext recover its plaintext through a CBC padding-oracle attack, because IesEngine.DecryptBlock strips padding and reports a distinguishable error before the MAC is checked. Exploitation requires non-default application behavior: IesEngine must be constructed directly with a padded block cipher such as AES-CBC with PKCS#7 padding, and the attacker must be able to repeatedly submit modified ciphertexts for decryption under the same static key pair and distinguish padding failures from MAC failures; stream-mode IES and standard ephemeral ECIES usage are explicitly unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor CVSS 4.0 score of 8.2 is materially moderated by these prerequisites, which our independent assessment rates as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

RemediationAI

Upgrade Bouncy Castle C

(bc-csharp) to 2.7.0 or later - the vendor-released patched version - which reorders IesEngine.DecryptBlock so the MAC is verified with a constant-time comparison before any decryption finalization or PKCS#7 unpadding, eliminating the distinguishable padding-versus-MAC error path. If 2.7.0 cannot be adopted immediately, the referenced upstream commits f881400b761134160ec2a05fd27c3e569453788d and eaa42e1e8125b3e2e25e365c4194c7cd5932360b (an upstream fix; a released patched version is only independently confirmed by the 2.7.0 advisory) can be backported, and the vendor wiki at https://github.com/bcgit/bc-csharp/wiki/CVE-2026-63567 should be reviewed for guidance. Actionable compensating controls, each with trade-offs: stop constructing IesEngine directly with a padded block cipher and instead use stream-mode IES or the standard ephemeral-sender-key ECIES initialization, accepting that this changes wire compatibility with existing peers; migrate payload protection to an authenticated-encryption construction such as AES-GCM, which removes the padding oracle by design but also changes the ciphertext format and requires coordinated client/server upgrades; and, where decryption is exposed to untrusted input, make all failure paths indistinguishable - return one generic error, constant response time and length, no differentiating logs, metrics, or status codes - which blunts the oracle but does not repair the underlying ordering flaw and can mask legitimate diagnostics. Note that the fix also warns against static-static key initialization, which yields a repeated keystream (many-time pad) in stream mode; deployments doing so should move to ephemeral keys as a separate hardening step. No vendor-released patch was identified for versions other than 2.7.0, and no public exploit code or confirmed active exploitation was observed at time of analysis.

Affected VersionsENISA

bc-csharp 0 <2.7.0

Affected Packages

euvd bc_csharp fix: 2.7.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

IES (Integrated Encryption Scheme, standardized as ECIES in SEC 1 and IEEE 1363a) is a hybrid public-key scheme: a KDF derives a symmetric cipher key and a MAC key from a shared secret Z, the message is encrypted, and a MAC is computed over the ciphertext plus encoding parameters. Correct implementations are MAC-then-verify rigorously - the authentication tag must be validated before any ciphertext is decrypted or unpad logic runs, so that all tampered inputs fail identically. In bc-csharp's Org.BouncyCastle.Crypto.Engines.IesEngine, the pre-2.7.0 DecryptBlock performed the cipher decryption and PKCS#7 unpadding first and only then computed the MAC; a padding error therefore surfaced as a distinct exception message and code path, while a MAC failure produced a different message and skipped the MAC computation entirely. That asymmetry is the root cause class, CWE-203 (Observable Discrepancy), and it is precisely the signal a CBC padding oracle needs: by flipping bytes and observing whether the response indicates bad padding or bad MAC, an attacker can recover plaintext block by block. The upstream fix restructures IesEngine so the MAC is verified with Arrays.FixedTimeEquals before any final block processing, defers the cipher's DoFinal/unpad until after authentication succeeds, and adds support for a transmitted IV/encoding vector (m_V, m_IV via ParametersWithIV) alongside hardening notes warning that static-static initialization produces a constant keystream and is effectively deterministic encryption. The affected code is the C

port distributed as bc-csharp under the Legion of the Bouncy Castle Inc. CPE, and only applications that instantiate IesEngine directly with a padded block cipher expose the weaker ordering; stream-mode IES and the usual ephemeral-sender-key ECIES construction never enter the vulnerable path.

Know when Bc Csharp gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (bcorg) PRIMARY 8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI 5.9 MEDIUM

AC:H because exploitation needs an adaptive chosen-ciphertext oracle and a non-default block-mode configuration; PR:N as no auth is implied; impact is confidentiality-only (plaintext recovery), so I/A:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (bcorg).

CVSS VectorVendor: bcorg

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC padding-oracle attack, because in block-cipher mode the engine decrypts the ciphertext and removes its padding before verifying the MAC. A padding failure is therefore reported with a different error message, and without the MAC computation, compared with a MAC failure. Only applications that construct IesEngine directly with a padded block cipher, such as AES in CBC mode with PKCS#7 padding, are affected; stream-mode IES is not.

Executive ViewAI

Why It Matters

Bouncy Castle C

(bc-csharp) versions before 2.7.0 contain a high-severity decryption flaw that, in a non-default IES/ECIES configuration using AES-CBC with PKCS#7 padding and a static key pair, could allow a remote attacker to recover plaintext from captured ciphertexts. No public exploit identified at time of analysis, and the required configuration is not the default library usage, but any affected application could expose sensitive encrypted data and erode trust in cryptographic protections. Leadership should direct owners of .NET applications using this package to verify exposure and apply the vendor fix promptly.

Business Impact: Medium

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.5%

Top 62% exploitable

Prevalence

High

bc-csharp is a widely deployed .NET cryptography library across many applications

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +41

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.