This vulnerability (CVE-2025-14813) concerns the use of a broken or risky cryptographic algorithm within the BC-JAVA library, specifically in the G3413CTRBlockCipher implementation. It affects multiple versions of BC-JAVA, starting from 1.59 up to versions before 1.80.2, 1.81 before 1.81.1, and 1.82 before 1.84. The issue is classified under CWE-327, indicating improper use of cryptographic algorithms that can compromise security. The CVSS 4.0 base score of 9.3 reflects critical severity with local attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No official remediation or patch is currently documented, and the vendor has not provided an advisory with fix details.

The vulnerability allows attackers with local access to potentially exploit the use of a broken or risky cryptographic algorithm, which can lead to compromise of confidentiality, integrity, and availability of data processed by the affected BC-JAVA versions. The critical CVSS score indicates a severe security risk if exploited. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is documented, users should avoid using affected versions and upgrade to versions 1.80.2 or later, 1.81.1 or later, and 1.84 or later once available. Monitor official Legion of the Bouncy Castle Inc. communications for updates and apply patches promptly when released.