The vulnerability stems from improper validation of the integrity check value in the AES‑CCM implementation of the Bouncy Castle bc‑csharp library. The CcmParameters object accepts any tag length, and the CcmBlockCipher verifies the length only during encryption. Consequently, a decryption routine may compare a zero‑length or a very short authentication tag, allowing an attacker to modify the ciphertext without detection. This flaw can be exploited by an on‑path attacker to silently alter data that is presumed protected by CCM.

Software affected is Legion of the Bouncy Castle Inc. bc‑csharp prior to version 2.7.0. The flaw exists in the classes CcmParameters and CcmBlockCipher and is exercised by common cryptographic helpers such as ParameterUtilities.GetCipherParameters, CmsEnvelopedData, and CmsEnvelopedDataParser when they process AES‑CCM‑protected EnvelopedData.

The vulnerability has a CVSS score of 8.2, which is considered high severity. EPSS data is not available and the issue is not listed in CISA’s KEV catalog, so the known exploitation probability cannot be quantified. An attacker who can position themselves on the network path can supply a CCMParameters instance with an out‑of‑range tag length and modify the ciphertext, with the decryption routine failing to detect the tampering. The lack of authentication integrity means the attacker can potentially achieve confidentiality and integrity compromise of the protected data.