CVE-2026-63573

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description A discrepancy exists in the CMS RSA PKCS#1 v1.5 key-transport unwrap process within the KeyTransRecipientInformation.UnwrapKey function. A remote attacker with a captured CMS EnvelopedData message can recover the content-encryption key and the message content by submitting multiple modified messages to an application. This is possible through a Bleichenbacher-style adaptive chosen-ciphertext attack, where the application reveals decryption failure details. Specifically, ciphertexts with invalid PKCS#1 v1.5 padding trigger a distinct CmsException stating "bad padding in message" during the unwrap process, rather than being replaced by a random key. This allows the attacker to distinguish between incorrectly padded ciphertexts and those that are correctly padded but fail during subsequent content decryption.

Recommendations Update bc-csharp to version 2.7.0 or later.