CVE-2026-63567: IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-02 · updated 2026-10-27
Weakness: CWE-203

Description

Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC padding-oracle attack, because in block-cipher mode the engine decrypts the ciphertext and removes its padding before verifying the MAC. A padding failure is therefore reported with a different error message, and without the MAC computation, compared with a MAC failure. Only applications that construct IesEngine directly with a padded block cipher, such as AES in CBC mode with PKCS#7 padding, are affected; stream-mode IES is not.

Affected products

Legion of the Bouncy Castle Inc. bc-csharp: before 2.7.0 — fixed in 2.7.0
Legion of the Bouncy Castle Inc. bc-csharp: before 2.7.0 — fixed in 2.7.0

How to fix

Upgrade to a fixed version: Legion of the Bouncy Castle Inc. bc-csharp 2.7.0; Legion of the Bouncy Castle Inc. bc-csharp 2.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-63567 or the next vulnerability affects your stack