The vulnerability arises because CcmParameters accepted any authentication tag length, including zero or lengths outside the RFC 5084 specification, and CcmBlockCipher only validated the tag length during encryption, not decryption. Consequently, during decryption, a zero-length or very short tag could be accepted, allowing an on-path attacker to alter encrypted content undetected. Affected code paths include ParameterUtilities.GetCipherParameters, CmsEnvelopedData, and CmsEnvelopedDataParser when handling AES-CCM encrypted data. This flaw exists in bc-csharp versions from 0 up to but not including 2.7.0.

An attacker positioned on the communication path can modify AES-CCM encrypted content without detection due to improper integrity check validation. This undermines the authenticity and integrity guarantees of the encryption scheme, potentially leading to data tampering without alerting the recipient. There is no indication of active exploitation in the wild at this time.

Upgrade to bc-csharp version 2.7.0 or later where this issue is fixed. Since the vulnerability is resolved in version 2.7.0, users should apply this official fix to prevent exploitation. No additional mitigations are specified or required beyond applying the patch.