Technical impact
An implementation flaw in the OpenPGP CFB quick‑check logic allows an attacker to observe the oracle responses when processing symmetric or session keys, ultimately revealing confidential key material. The weakness is a form of timing or discrimination oracle, as defined by CWE‑203, and could lead to the decryption of encrypted messages if an attacker can control input to the affected routine. The impact is loss of confidentiality for data protected by the compromised keys.
Affected Systems
The vulnerability affects Bouncy Castle for Java (BC‑JAVA) versions prior to 1.85, the Bouncy Castle for Java LTS (BC‑LTS‑JAVA) versions prior to 2.73.12, and the Bouncy Castle for Java FIPS (BC‑FJA) versions before bcpg‑fips 1.0.13, 2.0.13, and 2.1.13. Systems that rely on these libraries for OpenPGP encryption are at risk.
Risk and Exploitability
The CVSS score of 8.7 indicates high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported yet. The attack requires the ability to influence or observe CFB operations, implying that an attacker with access to the decryption process or who can supply crafted packets could incrementally recover key bits. Given the potential to compromise confidentiality, the risk remains significant until the libraries are updated.
