This vulnerability arises from the improper validation of the authentication tag in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in bc-csharp versions prior to 2.7.0. During decryption into a caller-supplied buffer, the plaintext is written before the authentication tag check, and if the tag verification fails, the plaintext remains in the buffer. This behavior can allow a remote attacker to obtain decryptions of chosen ciphertexts by sending forged messages to an application that exposes the output buffer, for example, through buffer reuse or logging. The issue does not affect methods that return newly allocated arrays for decrypted output.

An attacker can obtain decrypted plaintext of ciphertexts of their choosing by exploiting the premature release of unverified plaintext in the affected decryption methods. This can lead to information disclosure without requiring authentication or user interaction. The vulnerability affects confidentiality and could compromise sensitive data processed by applications using the vulnerable bc-csharp versions.

Upgrade to bc-csharp version 2.7.0 or later, where this issue is fixed. Avoid using decryption methods that write into caller-supplied buffers in affected versions. Since the vulnerability is fixed in version 2.7.0, applying this official update is the recommended remediation. Patch status is confirmed by the versioning information indicating the fix in 2.7.0.