The vulnerability allows a Bouncy Castle keystore to accept a legacy BKS format that uses a 16‑bit integrity MAC key. This weak key strength permits an attacker to alter the keystore contents without detection, leading to a compromise of data integrity. The weakness is classified as CWE‑326, which denotes insufficient key generation strength.

Affected products include Bouncy Castle Java libraries. Versions before 1.85 of the standard library and before 2.73.12 of the long‑term support library are vulnerable.

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, which suggests moderate exploitation likelihood. The attack vector is inferred to be local or remote depending on whether an attacker can supply a malicious keystore file; no additional requirements are specified in the description.