CVE-2026-12852

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/bcgit/bc-java/commit/a747038bb5bbd5e29fb2b7607ab38af1fd8d1790	Patch
https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012852	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En Bouncy Castle para Java antes de 1.85, el decodificador de trama MLS asigna una longitud opaca declarada por el atacante antes de la comprobación de límites.

Information

Published : 2026-08-03 04:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-12852

Mitre link : CVE-2026-12852

CVE.ORG link : CVE-2026-12852

JSON object : View

Products Affected

bouncycastle

bc-java

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-12852", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12852", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-03T15:11:15.405624Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "91579145-5d7b-4cc5-b925-a0262ff19630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "91579145-5d7b-4cc5-b925-a0262ff19630", "affectedData": [{"repo": "https://github.com/bcgit/bc-java", "vendor": "Legion of the Bouncy Castle Inc.", "modules": ["mls"], "product": "BC-JAVA", "versions": [{"status": "affected", "version": "1.73", "lessThan": "1.85", "versionType": "maven"}], "platforms": ["all"], "packageURL": "pkg:maven/org.bouncycastle/bcmls-jdk18on", "packageName": "bcmls", "programFiles": ["MLSInputStream"], "collectionURL": "https://www.bouncycastle.org/download/bouncy-castle-java/", "defaultStatus": "unaffected"}]}], "published": "2026-08-03T04:16:39.640", "references": [{"url": "https://github.com/bcgit/bc-java/commit/a747038bb5bbd5e29fb2b7607ab38af1fd8d1790", "tags": ["Patch"], "source": "91579145-5d7b-4cc5-b925-a0262ff19630"}, {"url": "https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012852", "tags": ["Third Party Advisory"], "source": "91579145-5d7b-4cc5-b925-a0262ff19630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "91579145-5d7b-4cc5-b925-a0262ff19630", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check."}, {"lang": "es", "value": "En Bouncy Castle para Java antes de 1.85, el decodificador de trama MLS asigna una longitud opaca declarada por el atacante antes de la comprobaci\u00f3n de l\u00edmites."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bouncycastle:bc-java:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA6A5663-2E62-44AA-8A64-A3CB0DC8813B", "versionEndExcluding": "1.85"}], "operator": "OR"}]}], "sourceIdentifier": "91579145-5d7b-4cc5-b925-a0262ff19630"}