The vulnerability lies in the IesEngine stream mode of the Legion of the Bouncy Castle Inc. bc‑csharp library when instantiated without a block cipher. During key derivation the MAC key is taken directly from the keystream that is also used for encryption. When an attacker observes one encrypted message with known plaintext, they learn the keystream for that message. Because the derivation input is static, the same keystream segment contains the MAC key for any message shorter than the original. The attacker can then craft a ciphertext and MAC tag for arbitrary short messages that the recipient will accept as authentic. This results in loss of integrity and authenticity for encrypted communications, allowing data tampering or injection.

Vendors: Legion of the Bouncy Castle Inc.; Product: bc‑csharp, versions prior to 2.7.0 are affected.

The CVSS score of 8.2 indicates a high severity. EPSS information is not available, so the exploitation probability is not quantified, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, based on passive or active network observation of a single encrypted message that the attacker can then use to forge shorter messages. The described path requires the attacker to obtain one ciphertext‑plaintext pair and to be able to inject forged messages into the target system. No additional credentials or privileged access are required, making exploitation straightforward for an attacker who can observe traffic.