The vulnerability resides in the CMS AuthEnvelopedData implementation of Bouncy Castle for Java where the library accepts ciphertext whose authentication tag length does not match the required length, thereby failing to verify integrity during decryption. This allows an attacker to craft a payload that the library will decrypt and accept, effectively bypassing the authenticity check and enabling the disclosure of protected data or the injection of forged data into applications that rely on the integrity of encrypted messages.

Affected products include Bouncy Castle for Java prior to version 1.85, the long‑term support branch before version 2.73.12, and the FIPS‑compliant branch (BC-FJA) before releases bcpkix-fips 1.0.12, 2.0.12, and 2.1.12 of the 1.0.X, 2.0.X, and 2.1.X series respectively. Any application that imports these libraries for CMS AuthEnvelopedData processing is potentially impacted.

The CVSS score of 8.7 indicates a high severity vulnerability. No EPSS score is available, and the entry is not listed in the CISA KEV catalog. The vulnerability can be exploited by supplying an adversary‑crafted CMS message that contains a non‑standard authentication tag length; the library will accept and decrypt it, granting the attacker access to confidential information or enabling integrity‑compromising attacks. The attack requires the presence of the vulnerable library within the target application and the ability to provide forged CMS data.