Legion of the Bouncy Castle BC-LTS up to 2.73.12.0 SHA3 SHAKE native_c/arm/sha/shake.C out-of-bounds write

Summaryinfo

A vulnerability classified as critical has been found in Legion of the Bouncy Castle BC-LTS up to 2.73.12.0. This vulnerability affects unknown code of the file native_c/arm/sha/shake.C of the component SHA3 SHAKE Handler. The manipulation leads to out-of-bounds write. This vulnerability is traded as CVE-2026-15997. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Legion of the Bouncy Castle BC-LTS up to 2.73.12.0 and classified as critical. This issue affects some unknown processing of the file native_c/arm/sha/shake.C of the component SHA3 SHAKE Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/shake.C, https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/sha3.C. This issue affects BC-LTS: from 2.73.0 before 2.73.12.1. Issue is only applicable if application involved is accepting memoable SHA3 / SHAKE states from potentially untrusted sources.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-15997 since 07/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 327683 (Linux Distros Unpatched Vulnerability : CVE-2026-15997), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.73.12.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (327683), EUVD (EUVD-2026-45068) and CERT Bund (WID-SEC-2026-2399). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Open Source Bouncy Castle

Productinfo

Vendor

• Legion of the Bouncy Castle

Name

• BC-LTS

Version

• 2.73.0
• 2.73.1
• 2.73.2
• 2.73.3
• 2.73.4
• 2.73.5
• 2.73.6
• 2.73.7
• 2.73.8
• 2.73.9
• 2.73.10
• 2.73.11
• 2.73.12.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion