The flaw stems from the DTLS handshake reassembler allocating a buffer based on an unchecked 24‑bit length field. Because the length value is not validated against the actual input size, an attacker can trigger a buffer overrun, causing memory corruption that may crash the application or potentially allow arbitrary code execution, as described by CWE‑789.

The vulnerability affects all Bouncy Castle for Java releases prior to 1.85, including the long‑term support branch before 2.73.12, and all Bouncy Castle for Java FIPS (BC‑FJA) builds before bctls‑fips 1.0.24, 2.0.24, and 2.1.24. Systems that use these libraries in DTLS implementations should verify their software version against these thresholds.

The CVSS score of 8.7 signals a high‑severity vulnerability, and although an EPSS score is not available, the absence of a KEV listing does not mitigate the risk of exploitation. An attacker can supply a malicious DTLS handshake packet to a server or client using the affected library, triggering the unchecked buffer allocation. Current mitigation requires applying the published patch or upgrading to a fixed library release.