Legion of the Bouncy Castle BC-LTS-JAVA up to 2.73.12 One-Shot Native Packet Ciphers KeyParameter.getKey buffer overflow

Summaryinfo

A vulnerability classified as critical was found in Legion of the Bouncy Castle BC-LTS-JAVA up to 2.73.12. Affected by this vulnerability is the function KeyParameter.getKey of the component One-Shot Native Packet Ciphers. Such manipulation leads to buffer overflow. This vulnerability is documented as CVE-2026-71883. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Legion of the Bouncy Castle BC-LTS-JAVA up to 2.73.12. Affected by this issue is the function KeyParameter.getKey of the component One-Shot Native Packet Ciphers. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key, IV and additional authenticated data arrays with JNI's ReleaseByteArrayElements in mode 0, which commits the native copy back into the Java array. Those arrays are read-only to the native code, and on a JVM that returns a copy rather than a pin the copy still holds the input bytes as they were read. The output buffer is taken through a separate critical region and committed first, so where an application passed the same Java array as both an input and the destination - encrypting in place over KeyParameter.getKey(), for example - the later mode-0 release of the key wrote the unchanged key bytes over the ciphertext that had just been produced. The call still returned the correct output length, so an application encrypting in place over its own key array was handed the raw AES key where it expected ciphertext, with nothing in the API to indicate it, and would transmit or store the key in place of the message. The read-only input arrays are now released with JNI_ABORT, freeing the native copy without copying it back, and mode 0 is reserved for arrays the native code wrote. The pure-Java packet ciphers and the streaming native modes are not affected. Bouncy Castle for Java (bcprov) is not affected, as it ships no native implementations.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-71883 since 08/08/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 2.73.13 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Vendor

• Legion of the Bouncy Castle

Name

• BC-LTS-JAVA

Version

• 2.73.0
• 2.73.1
• 2.73.2
• 2.73.3
• 2.73.4
• 2.73.5
• 2.73.6
• 2.73.7
• 2.73.8
• 2.73.9
• 2.73.10
• 2.73.11
• 2.73.12

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion