Legion of the Bouncy Castle bc-csharp: Release of unverified plaintext in CCM decryption
Summary
The CCM and DSTU 7624 CCM AEAD modes (CcmBlockCipher and KCcmBlockCipher) in bc-csharp write recovered plaintext into the caller-supplied output buffer before the authentication tag is checked. If the tag check fails, the unverified plaintext remains in that buffer. An attacker who can send forged ciphertexts and observe that buffer, for example through buffer reuse, logging or an error response, can obtain decryptions of chosen ciphertexts without a valid key. Only decryption into caller-supplied buffers is affected; methods that return a newly allocated array are not.
Affected
- bc-csharp 0 to before 2.7.0
- Per vendor wiki: BC C# .NET 2.6.2 and earlier, and the 2.7.0-beta.98 pre-release
- Platform: all CLRs
Fixed in
- bc-csharp 2.7.0 and later
- Fix commits: e0868323645a063cb2479646e93c1449dc338de5 (CcmBlockCipher) and 4ddb1d0bfeae3a81b18f4446d8cc8a7871bd2d9f (KCcmBlockCipher)
Workaround
- Decrypt CCM and KCCM messages only into a buffer used exclusively for that operation.
- After an InvalidCipherTextException, clear the buffer (for example with Array.Clear) before it is reused, logged or returned.
- Use the overloads that return a newly allocated array, such as ProcessPacket(byte[], int, int) and the IBufferedCipher DoFinal overloads that return a new array.
- These measures reduce exposure but do not replace the upgrade.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No evidence of in-the-wild exploitation or KEV listing found.
- No public proof of concept found in the research; this is not proof of absence.
- EPSS: 0.00286.
Our recommendation
- Inventory .NET applications and dependencies (for example NuGet packages) that use bc-csharp.
- Upgrade bc-csharp to version 2.7.0 or later, and verify any 2.7.0 beta builds against the fix commits.
- Ask software vendors whether their products embed bc-csharp below 2.7.0 and when they will fix it.
- Until patched, clear output buffers after failed decryptions and review logging of decryption output.
- Prioritise internet-facing applications that decrypt untrusted messages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor advisory: CVE-2026-103601 (bc-csharp wiki) github.com
- Fix commit: CcmBlockCipher tag verification github.com
- Fix commit: KCcmBlockCipher plaintext clearing github.com
- Bouncy Castle C# download and release notes www.bouncycastle.org
- NVD / Vulners record CVE-2026-103601 vulners.com
- OSV record CVE-2026-103601 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:32.
Original description (NVD)
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets the output buffer of a failed decryption be observed, for example through buffer reuse or logging, because decryption wrote the recovered plaintext into the caller-supplied output buffer before checking the authentication tag and left it there when the check failed. Only decryption into a caller-supplied buffer is affected; methods that return a newly allocated array are not.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.