CVE-2026-103601 CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check
Remote attackers can obtain plaintext from forged messages in Bouncy Castle C# CCM decryption if output buffers are reused or logged.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103601?
CVE-2026-103601 is a high-severity vulnerability in Legion of the Bouncy Castle Inc. bc-csharp, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker to obtain decryptions of ciphertexts of their choosing via forged messages sent to an application that lets the output buffer of a failed decryption be observed, for example through buffer reuse or logging, because decryption wrote the recovered plaintext into the caller-supplied output buffer before checking the authentication tag and left it there when the check failed. Only decryption into a caller-supplied buffer is affected; methods that return a newly allocated array are not.
Weakness: CWE-354
Which versions are affected by CVE-2026-103601?
It affects 1 product.
Products include Bouncycastle Bc-Csharp.
How do I fix CVE-2026-103601?
No fix has been published for CVE-2026-103601 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-103601 being exploited?
There is no known exploitation of CVE-2026-103601 in the wild and no public exploit code.
Other vulnerabilities in Legion of the Bouncy Castle Inc. bc-csharp
- CVE-2026-63569 MTI/A0 DHAgreement does not validate the peer's ephemeral value
- CVE-2026-103600 Unbounded ASN.1 nesting depth causes process-terminating stack overflow
- CVE-2026-103603 Unbounded HSS public key level count allows huge array allocation during signature verification
- CVE-2026-103604 Quadratic-time escaping when converting X.509 distinguished names to strings
- CVE-2026-16000 KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used
Sources
Also known as GHSA-v84x-v65q-m82v.