CVE-2026-12852
Received Received - Intake

Buffer Overflow in Bouncy Castle for Java

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: bcorg

Description
In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-03
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-12852
EUVD
EUVD-2026-52137

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bouncy_castle bcprov_jdk15on to 1.85 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Bouncy Castle for Java before version 1.85 involves a flaw in the MLS wire decoder where attacker-controlled opaque length values are allocated before proper bounds checking. This could allow an attacker to exploit memory allocation issues.

Detection Guidance

This vulnerability is specific to Bouncy Castle for Java versions before 1.85 and involves a bounds check issue in the MLS wire decoder. Detection requires checking the installed version of Bouncy Castle libraries in your Java environment. Use commands like 'mvn dependency:tree' in Maven projects or inspect the JAR files in your classpath for 'bcprov-jdk15on' to verify versions.

Impact Analysis

An attacker could exploit this to cause denial of service or potentially execute arbitrary code by sending maliciously crafted data. Systems using vulnerable Bouncy Castle versions may be at risk of crashes or unauthorized code execution.

Compliance Impact

The vulnerability involves improper bounds checking in the MLS wire decoder, potentially leading to denial of service or other impacts. However, the provided CVE data does not specify direct effects on compliance with GDPR, HIPAA, or similar standards. The CVSS score indicates high impact on availability, which could indirectly affect data integrity or availability requirements in regulations.

Mitigation Strategies

Upgrade Bouncy Castle for Java to version 1.85 or later to address the vulnerability in the MLS wire decoder.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12852. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart