Bouncy Castle bc-csharp: Padding oracle in IES/ECIES block-cipher decryption
Summary
The IesEngine class in bc-csharp checks CBC padding before verifying the MAC when it is constructed with a padded block cipher such as AES-CBC with PKCS#7. A remote attacker who has captured an IES or ECIES ciphertext and can submit modified ciphertexts for decryption under the same key pair can tell padding errors apart from MAC errors and may recover the plaintext without the private key. Stream-mode IES is not affected.
Affected
- bc-csharp (BouncyCastle.Cryptography) versions before 2.7.0
- Only applications that construct IesEngine directly with a padded block cipher (e.g. AES-CBC with PKCS#7)
- Stream-mode IES/ECIES is not affected
Fixed in
- Upgrade to bc-csharp 2.7.0 or later
Workaround
- Use IesEngine with the same CBC cipher without padding and remove the PKCS#7 padding yourself after the MAC has been verified (vendor-described option for users who cannot upgrade)
- Return one generic error for all decryption failures
Exploitation
- CISA SSVC: Exploitation none, not automatable
- No public proof of concept or evidence of exploitation found as of 1 Nov 2026
- Not listed in the CISA KEV catalogue
Our recommendation
- Inventory .NET applications and SBOMs for BouncyCastle.Cryptography below 2.7.0
- Check custom code for direct IesEngine use with padded block ciphers
- Upgrade to 2.7.0 or later and retest decryption
- Make sure all decryption failures return the same generic error
- Monitor the vendor wiki for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor wiki: CVE-2026-63567 github.com
- Fix commit f881400 (verify MAC before final decryption) github.com
- Follow-up commit eaa42e1 (restores Invalid MAC message) github.com
- OSV: CVE-2026-63567 osv.dev
- OpenCVE: CVE-2026-63567 app.opencve.io
- Vulners: CVE-2026-63567 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:33.
Original description (NVD)
Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC padding-oracle attack, because in block-cipher mode the engine decrypts the ciphertext and removes its padding before verifying the MAC. A padding failure is therefore reported with a different error message, and without the MAC computation, compared with a MAC failure. Only applications that construct IesEngine directly with a padded block cipher, such as AES in CBC mode with PKCS#7 padding, are affected; stream-mode IES is not.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.