The Bouncy Castle MLS wire decoder allocates a buffer whose size is declared in a message without first checking that the declared length is within the bounds of the remaining data. This out‑of‑bounds allocation can overwrite memory that the Java virtual machine or the application relies on, resulting in a crash, denial of service, or, if the attacker can control the overwritten area, arbitrary code execution. The vulnerability is classified as CWE‑789 (Buffer or Integer Overread) and can also lead to broader memory corruption (CWE‑1284).

Legion of the Bouncy Castle Inc. – BC‑JAVA, before release 1.85.

The CVSS score of 8.7 indicates high severity. The EPSS score of < 1% conveys a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no widespread exploitation is documented. Based on the description, it is inferred that an attacker can trigger the flaw by sending a crafted MLS wire message to any Java application that uses the vulnerable decoder, and the attack vector is likely remote. No additional conditions are required to exploit the vulnerability.