A failure to verify the authentication tag in CCM and DSTU 7624 CCM modes leaves plaintext in a caller‑supplied buffer when the tag check fails. This data is written back to the caller before the failure is detected, allowing an attacker who can inject forged ciphertexts to read the unverified plaintext. The flaw is an input validation weakness (CWE‑354). The effect is disclosure of confidential data to anyone who can observe the output buffer, for example through logging or buffer reuse, but it does not alter system integrity or enable arbitrary code execution.

The vulnerability affects Legion of the Bouncy Castle Inc.’s bc‑csharp library. Any project using bc‑csharp prior to version 2.7.0 that performs decryption by supplying its own output buffer is susceptible. Versions 2.7.0 and later contain a fix that defers plaintext output until after tag verification or removes the vulnerable path.

The CVSS score of 8.2 indicates high severity. EPSS data is not available, so exploitation probability is unknown, and the vulnerability is not currently listed in CISA KEV. Based on the description, the likely attack vector is a remote attacker sending crafted ciphertexts to an application that exposes the failed decryption output buffer, for example via logging, buffer reuse, or debugging interfaces. Attacks would that buffer and do not perform additional integrity checks.