Technical impact
Bouncy Castle for Java (BC-JAVA) and the Java FIPS variant (BC-FJA) contain a flaw in which policy failures for OpenPGP inline signatures are silently ignored. The library commits to a signature policy but falls back to processing the data without notifying the caller when the policy is violated. This means that a malformed or unsigned inline signature can be accepted as valid, effectively bypassing integrity checks. The issue has no restrictions on the attacker’s location; any source that can supply data to the affected application can trigger the failure.
Affected Systems
All installations of Bouncy Castle for Java older than version 1.85 and Bouncy Castle for Java FIPS (BC-FJA) before bcpg‑fips 2.0.13 that handle OpenPGP data with inline signatures are affected. Any Java application relying on these libraries to parse or validate PGP messages without additional policy enforcement is at risk.
Risk and Exploitability
The vulnerability scores a CVSS of 8.7, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers, whether local or remote, can craft data that appears to satisfy signature rules yet actually contains malicious content. If the consuming application accepts such data, it can lead to privilege escalation, premature execution of unauthenticated code, or other integrity‑related compromises. The lack of explicit notification makes detection difficult, increasing the likelihood that exploitation goes unnoticed.
