Unbounded allocation from OpenPGP signature and user attribute subpacket lengths
Summary
| CVE | CVE-2026-63574 |
|---|---|
| State | PUBLISHED |
| Assigner | bcorg |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-02 08:17:02 UTC |
| Updated | 2026-10-28 13:09:46 UTC |
| Description | Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeSubpacketsParser.ReadPacket) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote, unauthenticated attacker who can supply a crafted OpenPGP public key, certificate or signature to cause a denial of service (OutOfMemoryException or memory exhaustion in the parsing process) via a subpacket header using the five-octet length form, because the declared length was used to size the subpacket buffer with no upper bound and without being compared with the size of the enclosing subpacket area or packet, so a few bytes of input could demand an allocation of up to about 2 GB before any subpacket data was read. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from 91579145-5d7b-4cc5-b925-a0262ff19630
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.003740000 probability, percentile 0.312760000 (date 2026-10-28)
Problem Types: CWE-789 | CWE-789 CWE-789 Memory Allocation with Excessive Size Value
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 91579145-5d7b-4cc5-b925-a0262ff19630 | Secondary | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Bouncycastle | Bc-csharp | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Legion Of The Bouncy Castle Inc. | Bc-csharp | affected 2.7.0 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/bcgit/bc-csharp/commit/986fb4892bb39f292ba0fd82eba11d2cbc503217 | 91579145-5d7b-4cc5-b925-a0262ff19630 | github.com | Patch |
| github.com/bcgit/bc-csharp/commit/f51dacf4817d9ea10d0a9841f72fac3655c65483 | 91579145-5d7b-4cc5-b925-a0262ff19630 | github.com | Patch |
| github.com/bcgit/bc-csharp/wiki/CVE-2026-63574 | 91579145-5d7b-4cc5-b925-a0262ff19630 | github.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. (en)