CVE-2026-63574

Name of the Vulnerable Software and Affected Versions bc-csharp versions prior to 2.7.0

Description Remote, unauthenticated attackers can cause a denial of service through memory exhaustion or an OutOfMemoryException by providing a specially crafted OpenPGP public key, certificate, or signature. The issue exists in the SignatureSubpacketsParser.ReadPacket and UserAttributeSubpacketsParser.ReadPacket functions. It occurs when a subpacket header uses the five-octet length form, as the declared length is used to size the subpacket buffer without an upper bound or comparison to the size of the enclosing packet. Consequently, a small amount of input can trigger a memory allocation of approximately 2 GB before any data is actually read.

Recommendations Update bc-csharp to version 2.7.0 or later.