bc-csharp EUVD-2026-91231

Requires an application that decrypts attacker-influenced data using CcmBlockCipher (CCM) or KCcmBlockCipher (DSTU 7624 CCM) via the decryption path that writes into a CALLER-SUPPLIED output buffer, AND that lets the contents of that buffer be observed after a FAILED authentication-tag check - for example through buffer reuse across calls or by logging the output of a failed decryption. The attacker must be able to send forged ciphertexts to that decryption routine. LIMITING FACTORS: methods that return a newly allocated array are NOT affected; applications that discard the output buffer on a thrown InvalidCipherTextException are not exploitable; only the CCM and KCcm modes are in scope. These preconditions mean typical/default usage patterns that return arrays or do not expose the failed buffer are not vulnerable, significantly narrowing the realistic attack surface despite the network-facing CVSS vector.

Signals are mixed and lean toward 'elevated but conditional' rather than 'drop-everything urgent.' The vendor-assigned CVSS 4.0 score of 8.2 (High) reflects a network-reachable, unauthenticated chosen-ciphertext plaintext-recovery weakness (VC:H, with no integrity or availability impact). Crucially, the vector carries AT:P (Attack Requirement: Present), and the description makes that requirement concrete: exploitation only works against applications that both decrypt into a caller-supplied output buffer in CCM/KCcm modes AND let that buffer be observed after a failed authentication check (via buffer reuse or logging). This is effectively a padding-oracle-style weakness gated on a non-default application integration pattern, which materially lowers real-world exploitability versus the raw score. Exploitation status: no public exploit identified at time of analysis, and the issue is not listed in CISA KEV. No EPSS score and no SSVC decision data were provided in the input, so probabilistic and decision-framework signals cannot be weighed - this gap should be noted rather than assumed benign. Net: a genuine cryptographic defect worth patching promptly for any .NET application using Bouncy Castle CCM/KCcm decryption into reused buffers, but the deployment-specific precondition means it is not a blanket mass-exploitation risk.

An application uses bc-csharp CcmBlockCipher (or KCcmBlockCipher) to decrypt attacker-supplied messages into a caller-supplied output buffer that is subsequently reused, logged, or otherwise observable even when the authentication tag check fails. A remote, unauthenticated attacker repeatedly submits forged ciphertexts and reads the recovered-but-unverified plaintext left in that buffer, acting as a decryption oracle to recover the plaintext of ciphertexts of their choosing. No public exploit code was identified in the provided data, but the technique is a well-understood release-of-unverified-plaintext (CWE-354) attack.