CVE-2026-15997

EUVD-2026-45068

16.07.2026, 23:16

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers.

This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/shake.C, https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/sha3.C.

This issue affects BC-LTS: from 2.73.0 before 2.73.12.1.

Issue is only applicable if application involved is accepting memoable SHA3 / SHAKE states from potentially untrusted sources.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 1%

Ubuntu Releases

Ubuntu Product

Codename

bouncycastle

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage

Common Weakness Enumeration

CWE-787 - Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.

Vulnerability Media Exposure

[GERMAN] Bouncy Castle: Schwachstelle ermöglicht nicht spezifizierten Angriff
Ein lokaler Angreifer kann eine Schwachstelle in Bouncy Castle ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Published: 2026-07-16T22:00:00+00:00

References

https://github.com/bcgit/bc-lts-java/wiki/CVE-2026-15997