CVE-2025-9340: native encrypt/decrypt operations in JCE may corrupt data if same byte array used for input and output.
Out-of-bounds Write vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bc-fips on All (API modules). This vulnerability is associated with program files org/bouncycastle/jcajce/provider/BaseCipher.
This issue affects Bouncy Castle for Java: from BC-FJA 2.1.0 through 2.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.bouncycastle:bc-fipsto a version that resolves this vulnerability.Fixed in 2.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9340?
CVE-2025-9340 has a medium severity rating due to its potential for out-of-bounds write impacts.
How do I fix CVE-2025-9340?
To fix CVE-2025-9340, upgrade Bouncy Castle for Java to a version later than 2.1.0.
What are the potential impacts of CVE-2025-9340?
CVE-2025-9340 could lead to arbitrary code execution due to memory corruption from the out-of-bounds write.
Which versions of Bouncy Castle are affected by CVE-2025-9340?
CVE-2025-9340 affects Bouncy Castle for Java version 2.1.0.
Is CVE-2025-9340 a known issue in the Bouncy Castle library?
Yes, CVE-2025-9340 is a documented vulnerability within the Bouncy Castle library.