Bouncy Castle bc-csharp EUVD-2026-91226

The victim application must call Bouncy Castle bc-csharp (before 2.7.0) code paths that process attacker-controlled input through Pkcs12ParametersGenerator - specifically loading a PKCS#12/PFX file (e.g. Pkcs12Store.Load) or decrypting a PKCS#8 private key that uses a PKCS#12 password-based encryption algorithm. The specific trigger is a MacData (or PBE) iteration count of zero or a negative value, which causes the derivation loop to wrap through ~2^32 iterations before any MAC/password validation. Key LIMITING factors: exploitation requires the application to actually accept and parse untrusted PFX/PKCS#8 data (UI:P / user-interaction-dependent), and impact is confined to CPU/availability exhaustion - there is no code execution, data disclosure, or integrity loss. Services that only process trusted, internally-generated keystores are not realistically exposed.

This is a genuine but bounded availability risk, not a high-severity critical. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 7.1 driven entirely by availability impact (VA:H) with zero confidentiality or integrity effect - consistent with a CWE-835 unbounded-loop DoS. The vector requires passive user interaction (UI:P), meaning exploitation depends on the victim application actually loading/parsing an attacker-supplied PKCS#12 (PFX) or PKCS#8 file, so this is not a fully autonomous network worm despite AV:N. No EPSS score, SSVC decision data, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the practical priority therefore rests on how exposed the affected application's file-parsing path is to untrusted input. The one conflicting signal to verify: AV:N implies network reachability, but the real trigger is processing a malicious file (75-byte PFX with a negative/zero MacData iteration count), so actual reachability is application-specific - a backend service that ingests user-uploaded certificates is at real risk, whereas a library linked but never fed untrusted PFX data is not. Patch is available from the vendor (bc-csharp 2.7.0), which makes remediation straightforward and lowers residual risk.

An attacker uploads a tiny (~75-byte) crafted PFX file, or supplies a PKCS#8 encrypted private key using a PKCS#12 password-based algorithm, to any service that parses it via Bouncy Castle's Pkcs12Store.Load or Pkcs12ParametersGenerator. Because the MacData iteration count is zero or negative, the key-derivation loop wraps through roughly 2^32 iterations before the MAC or password is ever checked, pinning a CPU core for many minutes per file. No public exploit code was provided, but the trigger is trivial to reproduce from the public description and patch diff.