The Azure SDK for Java’s Key Vault Keys library has a flaw in its local cryptographic verification path where authentication tag comparison is performed incorrectly. Applications that rely on that local cryptography path may accept specially crafted encrypted input and bypass integrity verification checks. Notably, calls to the remote Key Vault service remain correctly protected and are not affected by this flaw.

Microsoft Azure SDK for Java, specifically the Key Vault Keys library. The vulnerability is present in all released versions before 4.10.6; version 4.10.6 and later contain the fix.

The CVSS score of 9.1 classifies this flaw as critical, indicating a high potential impact. The EPSS score of less than 1% suggests that the probability of exploitation is currently very low. The vulnerability is not yet listed in CISA’s KEV catalog, and no public exploits have been reported. Based on the description, the likely attack vector would be over a network, where an attacker could supply crafted ciphertext to a client application that uses the vulnerable local cryptographic path, causing it to accept tampered data as authentic. The flaw does not affect operations delegated to the Key Vault service.