Bouncy Castle C# EUVD-2026-91224

Exploitation requires a specific confluence of conditions, not a default-configuration remote attack. The attacker must (1) already hold a captured CMS EnvelopedData message that uses RSA PKCS#1 v1.5 key transport (KeyTransRecipientInformation), and (2) have access to an application built on bc-csharp before 2.7.0 that decrypts attacker-submitted messages with the recipient's RSA private key and (3) exposes a distinguishable response between the 'bad padding in message' CmsException (invalid PKCS#1 padding rejected during UnwrapKey) and a later content-decryption failure. The attacker must also be able to send a large volume of adaptively modified ciphertexts. Limiting factors: the oracle only exists for legacy PKCS#1 v1.5 key transport (OAEP is unaffected); the application must leak the error discrepancy (timing or explicit error) for the oracle to be observable; the attack needs many queries, making rate limiting or logging a meaningful mitigation; and after 2.7.0 the constant-time fixed-length unwrap removes the oracle unless an operator explicitly re-enables the legacy path via the Org.BouncyCastle.Cms.AllowLenientRsaPkcs1 property.

This is a genuine but conditional cryptographic risk rather than a mass-exploitable flaw. The provided CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 8.2 (High) and correctly flags the key limiter via AT:P (Attack Requirements Present): the attacker must already possess a captured CMS EnvelopedData message AND have access to an application that acts as a decryption oracle leaking how decryption failed. No EPSS score was supplied, so statistical exploitation likelihood cannot be quantified. There is no CISA KEV listing and no public exploit was identified in the provided intelligence, so per policy this is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. CWE-203 (observable discrepancy) matches the root cause precisely: invalid PKCS#1 v1.5 padding throws a distinct 'bad padding in message' CmsException instead of substituting a random key, creating a Bleichenbacher padding oracle. The signals are internally consistent - high confidentiality impact (VC:H) with no integrity/availability impact (VI:N/VA:N) aligns with a message-recovery attack. The practical gating factor is the AT:P requirement: a passive library consumer with no distinguishable error disclosure and no attacker-submitted-ciphertext path is not realistically exploitable, so real priority should be scoped to applications that decrypt untrusted CMS messages and expose differential failure behavior.

An attacker captures a CMS EnvelopedData message protected with RSA PKCS#1 v1.5 key transport and then repeatedly submits adaptively modified copies to a service (e.g. a decryption/validation endpoint) that unwraps them with the recipient's RSA private key and returns distinguishable errors. By observing which ciphertexts trigger the distinct 'bad padding in message' CmsException versus a later content-decryption failure, the attacker runs a Bleichenbacher adaptive chosen-ciphertext attack to recover the content-encryption key and decrypt the original message. No public proof-of-concept exploit was identified in the provided data, and the attack requires many queries plus an observable error-discrepancy oracle.