CVE-2026-15997 is an out-of-bounds write vulnerability in the BC-LTS library by Legion of the Bouncy Castle Inc., specifically in the bcprov-lts8on component on ARM platforms. The vulnerability arises from improper handling of memoable SHA3 / SHAKE states when these states are accepted from untrusted sources, leading to potential buffer overflow conditions. The affected source files are native C implementations for ARM: sha/shake.C and sha/sha3.C. This issue impacts BC-LTS versions starting at 2.73.0 and prior to 2.73.12.1. The CVSS 4.0 base score is 1.7, indicating low severity, with attack vector local, high attack complexity, and partial remediation expected. No known exploits are reported in the wild, and no official patch or remediation level has been published yet.

The vulnerability allows out-of-bounds write operations which could lead to memory corruption if an application processes memoable SHA3 / SHAKE states from untrusted sources. The impact is limited by the requirement for local access and high attack complexity. There is no indication of privilege escalation or remote exploitation without user interaction. The CVSS score reflects a low severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid accepting memoable SHA3 / SHAKE states from untrusted sources in applications using BC-LTS versions >=2.73.0 <2.73.12.1. Monitor vendor communications for updates on patches or official mitigations.