bc-csharp EUVD-2026-91223

The target application must invoke Pkcs12Store.Load or Pkcs12Utilities.ConvertToDefiniteLength (bc-csharp before 2.7.0) on a PKCS#12/PFX file whose content is attacker-controlled, with a crafted iteration count near 2^31 placed in MacData or in the PBE parameters of an encrypted SafeContents or shrouded key bag. No valid password or MAC is required because key derivation executes before the MAC or password is checked (PR:N). The key LIMITING factor is UI:P: an attacker cannot trigger this remotely on their own - a victim application or user must actually accept and load the malicious keystore, so deployments that only process trusted local PFX files are not realistically exposed.

This is a genuine but moderate-priority denial-of-service issue, not a high-impact RCE despite the 7.1 score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) shows the real shape: impact is availability-only (VA:H) with no confidentiality or integrity effect, and exploitation requires passive user interaction (UI:P) - specifically, a victim application must load an attacker-supplied PKCS#12/PFX file. The source-code evidence (fix adds a DefaultMaxIterations=5,000,000 bound via Pkcs12Utilities.ValidateIterations) confirms the root cause: the iteration count is read from the file with no upper bound and key derivation runs BEFORE the MAC or password is checked, so no authentication to the keystore is needed. Exploitation status is 'no public exploit identified at time of analysis' - the input provides neither KEV nor POC signals, and no EPSS score is supplied, so exploitation probability cannot be quantified. Real-world risk hinges entirely on whether a given deployment feeds untrusted PFX files into bc-csharp; for services that accept user-uploaded keystores this is a realistic availability threat, while for applications that only load trusted local keystores the practical risk is low.

An attacker uploads or submits a crafted PKCS#12 (PFX) file to an application that uses bc-csharp (before 2.7.0) to load keystores - for example a certificate-import endpoint. When the application calls Pkcs12Store.Load (or Pkcs12Utilities.ConvertToDefiniteLength), the embedded MacData or PBE iteration count near 2^31 drives key derivation before any MAC/password check, pinning a CPU core and causing denial of service. No public exploit code is identified at time of analysis, but the condition is trivial to craft given the published fix.