The vulnerability identified as CVE-2026-12802 (CWE-354) affects Bouncy Castle for Java's CMS AuthEnvelopedData implementation. The flaw is due to failure to enforce tag-length during decryption, which compromises the integrity validation mechanism. Affected versions include BC-JAVA before 1.85, Bouncy Castle for Java LTS versions from 2.73.0 up to but not including 2.73.12, and multiple BC-FJA FIPS series versions before their respective 1.0.12, 2.0.12, and 2.1.12 releases. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on integrity. No official remediation level or patch links are provided in the data, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker to bypass integrity checks during decryption of CMS AuthEnvelopedData, potentially leading to unauthorized data manipulation or acceptance of tampered data. The high CVSS score reflects significant impact on data integrity without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level is provided in the available data. Users should monitor Legion of the Bouncy Castle Inc. advisories for updates and apply patches once available. Until then, consider restricting use of affected versions in sensitive environments.