CVE-2026-63573: Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap
Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an application that decrypts them with the recipient's RSA private key and reveals how decryption failed, to recover the captured message's content-encryption key and so its content, via a Bleichenbacher-style adaptive chosen-ciphertext attack, because a key-transport ciphertext with invalid PKCS#1 v1.5 padding is rejected during unwrap with a distinct "bad padding in message." CmsException instead of being replaced by a random key, so it can be told apart from a correctly padded ciphertext, which fails only later at content decryption.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which deployments are exposed to this attack?
Deployments using bc-csharp before 2.7.0 to decrypt CMS EnvelopedData with RSA PKCS#1 v1.5 key transport are exposed if they reveal whether failure occurred during key unwrap or later during content decryption.
What does an attacker need to exploit the issue?
The attacker needs a captured CMS EnvelopedData message and the ability to submit many modified versions of that message to an application that decrypts them using the recipient's RSA private key. The application must expose distinguishable failure behavior, including the distinct bad-padding exception from key unwrap.
What information can be recovered if exploitation succeeds?
A successful adaptive chosen-ciphertext attack can recover the captured message's content-encryption key. The attacker can then decrypt that message's content.
What is the remediation?
Upgrade bc-csharp to version 2.7.0 or later. The affected behavior is present in versions before 2.7.0.