The vulnerability is in the IESEngine implementation of Bouncy Castle for Java. A length‑dependent key derivation function (KDF) split allows an attacker to forge a MAC in stream‑mode authentication, thereby bypassing the integrity check for encrypted data. If an attacker can submit forged ciphertext‑MAC pairs, they can alter or create messages that the system will accept as valid, potentially leading to unauthorized data modification or execution of commands depending on how the library is used.

Affected products are Legion of the Bouncy Castle Inc. BC‑JAVA and BC‑LTS‑JAVA. Versions before 1.85 for BC‑JAVA and before 2.73.12 for the LTS variant are vulnerable. Any application that imports these libraries before the specified versions may be impacted.

The CVSS score is 8.7, indicating a high‑severity flaw. Because the EPSS score is not available, the current exploitation probability cannot be quantified from public data. The issue is not listed in the CISA KEV catalog. The attack is likely to occur in systems that use Bouncy Castle’s stream‑mode MAC functions, requiring the attacker to supply crafted data that the application will process. Successful exploitation would give the attacker the ability to forge authentication tags, effectively compromising data integrity and potentially allowing further attacks such as replay or unauthorized operations if the application trusts the MAC alone.