CVE-2026-12816 in BC-JAVA
Summary
by MITRE • 08/03/2026
In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The vulnerability in Bouncy Castle for Java versions prior to 1.85 and LTS versions before 2.73.12 represents a critical cryptographic weakness in the IESEngine implementation that allows for stream-mode message authentication code forgery. This flaw specifically exploits a length-dependent Key Derivation Function (KDF) split mechanism within the Integrated Encryption Scheme engine, creating opportunities for attackers to manipulate and forge MAC values without possessing the legitimate encryption keys.
The technical root cause lies in how the IESEngine handles key derivation when operating in stream mode, where the KDF processes data in segments that are dependent on message length. When the KDF splits input data based on varying lengths, it creates predictable patterns that can be exploited by adversaries to construct valid MACs for modified ciphertext. This vulnerability stems from insufficient cryptographic separation between different components of the encryption process and inadequate handling of edge cases in the key derivation algorithm.
The operational impact of this vulnerability is significant across various security contexts where Bouncy Castle's IESEngine is deployed. Attackers can forge MAC values for encrypted messages, undermining the integrity protection that should be provided by the Integrated Encryption Scheme. This allows for man-in-the-middle attacks where malicious actors can modify encrypted communications without detection, potentially leading to unauthorized data access or manipulation of critical information flows. The vulnerability affects systems using the IESEngine in stream mode, particularly those implementing protocols that rely on authenticated encryption with associated data.
This weakness aligns with CWE-310, which addresses cryptographic issues related to key derivation and authentication failures, and maps to ATT&CK technique T1552.006 for unsecured credentials and T1071.004 for application layer protocol communication. The vulnerability demonstrates poor implementation of cryptographic primitives where length-dependent operations create exploitable side channels that compromise the security guarantees of authenticated encryption.
Mitigation strategies require immediate upgrading to Bouncy Castle versions 1.85 or LTS 2.73.12 and later, which contain proper fixes for the KDF splitting mechanism in IESEngine. Organizations should also implement additional monitoring for unauthorized cryptographic operations and consider implementing supplementary integrity checks beyond the standard MAC verification. Security teams must review all systems utilizing the affected IESEngine implementations and validate that updated libraries are properly deployed across all environments. Additional defensive measures include implementing strict access controls for cryptographic operations and regular security assessments to identify potential exploitation vectors in legacy systems using vulnerable Bouncy Castle versions.