The vulnerability allows an attacker to trigger an out‑of‑memory condition by allocating an unbounded amount of memory when the library performs a definite‑length read. This can lead to application crashes or forced restarts, disrupting service availability. The weakness is classified as CWE‑789, indicating unbounded or excessive memory allocation.

Legion of the Bouncy Castle Inc. products including BC‑FJA, BC‑JAVA, and BC‑LTS‑JAVA are affected. Versions before 1.85 of BC‑JAVA, before 2.73.12 of BC‑LTS‑JAVA, before bc‑fips 1.0.2.7 (1.0.x series), 2.0.2 (2.0.x series) and 2.1.3 (2.1.x series) of BC‑FJA, and before bctls‑fips 1.0.24 are vulnerable.

The CVSS score of 8.7 indicates a high severity vulnerability with significant impact on availability. EPSS data is not available, but the lack of a KEV listing suggests it has not yet been widely exploited. The likely attack vector is that an adversary could supply a large or maliciously crafted input that forces the library to allocate excessive memory during a read operation, potentially causing the application to crash or become unresponsive.