The vulnerability identified as CVE-2026-12185 in BC-JAVA arises from the library allocating memory based on untrusted length values before verifying their integrity in the BKS/UBER keystore components. This can lead to excessive memory allocation, potentially causing denial of service or other impacts related to resource exhaustion. The issue affects BC-JAVA versions earlier than 1.85 and versions starting from 2.73.0 up to 2.73.12 (exclusive). There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to trigger memory allocation with excessive size values, which may lead to denial of service or resource exhaustion conditions. No evidence of code execution or data compromise is provided. The CVSS 4.0 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Users should monitor the vendor's announcements for patches addressing this vulnerability.