CVE-2026-15997

EUVD-2026-45068

16.07.2026, 23:16

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers.

This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/shake.C, https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/sha3.C.

This issue affects BC-LTS: from 2.73.0 before 2.73.12.1.

Issue is only applicable if application involved is accepting memoable SHA3 / SHAKE states from potentially untrusted sources.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 3.34%

Debian Releases

Debian Product

Codename

bouncycastle

bookworm	1.72-2 fixed
bullseye	1.68-2 fixed
forky	1.80-3 fixed
sid	1.80-3 fixed
trixie	1.80-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

bouncycastle

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

References

https://github.com/bcgit/bc-lts-java/wiki/CVE-2026-15997