CVE-2026-63573 in bc-csharp
Summary
by MITRE • 10/02/2026
Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an application that decrypts them with the recipient's RSA private key and reveals how decryption failed, to recover the captured message's content-encryption key and so its content, via a Bleichenbacher-style adaptive chosen-ciphertext attack, because a key-transport ciphertext with invalid PKCS#1 v1.5 padding is rejected during unwrap with a distinct "bad padding in message." CmsException instead of being replaced by a random key, so it can be told apart from a correctly padded ciphertext, which fails only later at content decryption.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in the Legion of Bouncy Castle Inc bc-csharp library prior to version 2.7.0 represents a critical implementation flaw within the CMS RSA PKCS#1 v1.5 key-transport mechanism. Specifically, the issue resides in the KeyTransRecipientInformation.UnwrapKey function which is responsible for decrypting and unwrapping content encryption keys encrypted via RSA public-key cryptography using the PKCS#1 version 1.5 padding scheme. This flaw creates a side-channel through timing or error message differentiation that allows an attacker to perform Bleichenbacher-style adaptive chosen-ciphertext attacks against systems relying on this library for secure key exchange in Cryptographic Message Syntax environments.
The core technical deficiency lies in how the library handles invalid PKCS#1 v1.5 padding during the decryption process. In a properly implemented system, when a ciphertext with incorrect or malformed padding is submitted to an RSA private key operation, the implementation should fail silently by generating a random plaintext value and proceeding to subsequent validation steps such as content decryption verification. This technique ensures that the application's response time or error output remains consistent regardless of whether the padding was valid but the resulting data was invalid later in the process, or if the padding itself was structurally incorrect from the start. However, bc-csharp versions before 2.7.0 explicitly detect and reject ciphertexts with bad PKCS#1 v1.5 padding by throwing a distinct CmsException labeled as "bad padding in message." This explicit error handling creates an observable discrepancy that distinguishes between two states: one where the padding is valid but subsequent decryption fails, and another where the padding structure itself is invalid.
This distinction enables remote attackers to exploit the vulnerability through adaptive chosen-ciphertext attacks. An attacker who possesses a captured CMS EnvelopedData message can submit numerous modified versions of this ciphertext to an application that decrypts messages using the recipient's RSA private key. By carefully crafting these submissions and observing whether the server returns the specific "bad padding" exception or proceeds further into the decryption pipeline, the attacker gains oracle access. This oracle provides binary feedback regarding the validity of the PKCS#1 v1.5 padding structure in each submitted ciphertext. Over many iterations, this information allows the attacker to mathematically reconstruct the original RSA plaintext without knowing the private key, effectively recovering the content-encryption key embedded within that message.
Once the content-encryption key is recovered through this oracle attack, the confidentiality of the captured CMS EnvelopedData message is completely compromised. The attacker can use the recovered symmetric key to decrypt the actual payload or data contained within the envelope. This undermines the fundamental security guarantees provided by public-key cryptography in transport scenarios, allowing unauthorized access to sensitive information that was presumed secure during transmission. The impact is severe because it allows decryption of past traffic if such messages were captured and stored for later analysis, a common practice in many enterprise environments for auditing or archival purposes.
From a classification perspective, this vulnerability aligns with CWE-358: Improperly Implemented Security Check for Common Criteria which covers failures to properly validate inputs leading to security bypasses, but more specifically it maps directly to CWE-204: Observable Response Discrepancy and CWE-209: Generation of Error Message Containing Sensitive Information. In terms of the MITRE ATT&CK framework, this exploitation technique falls under T1558.003: Steal or Forge Kerberos Tickets using Golden Ticket which is not applicable here but rather maps to T1407.002: System Binary Proxy Execution via Side Channels and more accurately to techniques involving adaptive chosen-ciphertext attacks often associated with cryptographic oracle exploitation patterns found in advanced persistent threat operations targeting key exchange mechanisms.
Mitigation for this vulnerability requires an immediate upgrade of the bc-csharp library to version 2.7.0 or later where the implementation has been corrected to prevent observable discrepancies based on padding validity. For systems that cannot be immediately upgraded, defensive coding practices should be implemented at the application layer to ensure consistent error handling and response times regardless of whether a cryptographic operation fails due to invalid padding versus other decryption errors. This includes implementing constant-time comparison algorithms for any subsequent validation steps and ensuring that generic internal server errors are returned to clients instead of detailed exception messages like "bad padding in message." Additionally, organizations should review their CMS implementations to ensure they do not expose granular failure states related to cryptographic operations over network interfaces accessible by untrusted parties.