The vulnerability CVE-2026-12803 in BC-JAVA arises from the KCCMBlockCipher MAC implementation failing to bind the nonce when no Additional Authenticated Data (AAD) is provided. This improper validation of the integrity check value (CWE-354) allows an attacker to perform cross-nonce AEAD forgery attacks. The affected versions are all BC-JAVA releases prior to 1.85 and LTS releases starting at 2.73.0 but before 2.73.12. The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on integrity. No official remediation level or patch information is provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to forge authenticated encryption with associated data (AEAD) ciphertexts across different nonces, undermining the cryptographic guarantees of message integrity and authenticity. This could lead to acceptance of forged messages or data tampering without detection in affected BC-JAVA versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, users should monitor the Legion of the Bouncy Castle Inc. advisories for updates. Until a fix is available, avoid using affected versions in security-critical environments or apply any recommended workarounds from the vendor.