The vulnerability occurs in the CCM-family modes of Bouncy Castle for Java, where the library writes plaintext to the caller buffer before verifying the authentication tag. Because the data is left in memory before integrity is confirmed, an attacker who can inject malicious ciphertext may be able to read unverified plaintext. This weakness can lead to confidentiality loss when the library is used by applications that do not enforce tag checks strictly, potentially undermining the overall data integrity guarantees of the encryption process.

Affected products include Bouncy Castle for Java before version 1.85, the Bouncy Castle for Java LTS releases before 2.73.12, and Bouncy Castle for Java FIPS (BC‑FJA) before bc‑fips 1.0.2.7 in the 1.0.x series, 2.0.2 in the 2.0.x series, and 2.1.3 in the 2.1.x series. Any application that depends on these library versions is potentially exposed.

The vulnerability has a CVSS score of 8.7, indicating high severity. No EPSS score data is available, and the issue is not listed in the CISA KEV catalog, suggesting no widely observed exploitation yet. The likely attack vector involves a malicious client supplying crafted CCM-encrypted data to a vulnerable application; the application’s use of the library would expose plaintext before tag verification, enabling data disclosure. The risk is therefore elevated for systems that process user-supplied encrypted data and cannot enforce tag checks independently.