Bouncy Castle C# EUVD-2026-91225

Exploitable whenever an application uses bc-csharp before 2.7.0 to parse attacker-supplied OpenPGP material (public keys, certificates, or signatures) through SignatureSubpacketsParser.ReadPacket or UserAttributeSubpacketsParser.ReadPacket - common in PGP key-import, signature-verification, or keyserver features. The specific trigger is a subpacket header using the five-octet (0xFF) length form declaring a body up to ~4 GB, which is used to size the buffer with no upper bound. No authentication, user interaction, or non-default configuration is required; the only prerequisite is that the service accepts and parses untrusted OpenPGP data. Limiting factor: impact is confined to availability (process crash/memory exhaustion) with no data disclosure or code execution, and services that never parse untrusted OpenPGP input are not exposed.

This is a genuine, easy-to-trigger denial-of-service rather than a critical system-compromise issue, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity trigger with no user interaction, and the impact profile (VC:N/VI:N/VA:H) correctly scopes this to availability only - no confidentiality or integrity loss, matching CWE-789 (memory allocation with excessive size value). The 8.7 'High' score is driven almost entirely by the availability impact being reachable pre-authentication; it should NOT be read as a code-execution threat. Exploitation is trivially reliable per the source evidence (a few header bytes using the five-octet length form force an allocation of up to ~2 GB before any body is read), which realistically explains the low attack complexity. No EPSS score, KEV listing, or public POC was provided in the input; absence of these means exploitation is not confirmed in the wild, but the fix commit ships a regression test that effectively demonstrates the trigger, lowering the bar to reproduce. Net priority: patch promptly for any service that parses untrusted OpenPGP material, but treat this as availability hardening, not an emergency compromise scenario.

An attacker submits a crafted OpenPGP public key, certificate, or signature to a .NET service that parses it with bc-csharp (for example an email/PGP verification endpoint or a key-upload feature). A single subpacket whose five-octet length header declares a near-4 GB body causes the signature or user-attribute subpacket parser to attempt a multi-gigabyte buffer allocation before reading any data, throwing OutOfMemoryException or exhausting process memory. No public exploit was identified at time of analysis, though the vendor fix includes a regression test that constructs the triggering packet.