Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured an IES or ECIES ciphertext, and who can submit modified ciphertexts for decryption under the same key pair, to recover its plaintext via a CBC padding-oracle attack, because in block-cipher mode the engine decrypts the ciphertext and removes its padding before verifying the MAC. A padding failure is therefore reported with a different error message, and without the MAC computation, compared with a MAC failure. Only applications that construct IesEngine directly with a padded block cipher, such as AES in CBC mode with PKCS#7 padding, are affected; stream-mode IES is not.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 3
https://github.com/bcgit/bc-csharp/commit/eaa42e1e8125b3e2e25e365c4194c7cd59323…
91579145-5d7b-4cc5-b925-a0262ff19630
https://github.com/bcgit/bc-csharp/commit/f881400b761134160ec2a05fd27c3e5694537…
91579145-5d7b-4cc5-b925-a0262ff19630
https://github.com/bcgit/bc-csharp/wiki/CVE-2026-63567
91579145-5d7b-4cc5-b925-a0262ff19630