Technical impact
The vulnerability resides in the RSA PKCS#1 signature verification routine of Bouncy Castle for Java before version 1.85 and its LTS branch before 2.73.12. During verification of signatures using the NULL‑omitted path, the library skips the final two bytes of the hash. As a result, a crafted signature that differs only in those two bytes can be accepted as valid, effectively forging the signature. This flaw undermines integrity because forged signatures can be used to impersonate legitimate signers, potentially leading to unauthorized code execution, data tampering, or fraudulent documents. The weakness is catalogued as CWE‑347.
Affected Systems
Affected products are Bouncy Castle’s Java libraries: BC-JAVA prior to version 1.85 and BC‑LTS‑JAVA prior to 2.73.12. Applications that depend on these libraries for RSA signature verification are at risk.
Risk and Exploitability
With a CVSS score of 8.7, the flaw is classed as high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that publicly available exploits have not yet been documented. The likely attack vector is any application that accepts user-supplied data and verifies RSA signatures using the affected library; by supplying a subtly altered signature that only differs in the last two hash bytes, an attacker can bypass the check. The impact is that the attacker can gain integrity privileges that the signature is meant to prevent.
