The vulnerability CVE-2026-59641 in BC-JAVA arises from the S/MIME validator trusting the signer-asserted signingTime for path validation, which constitutes insufficient verification of data authenticity (CWE-345). This flaw affects BC-JAVA versions prior to 1.85 and versions from 2.73.0 up to 2.73.12, as well as specific FIPS series versions. The CVSS 4.0 base score is 8.7, reflecting a network attack vector with low complexity and no privileges or user interaction required, but with high impact on integrity. The vendor has not yet provided an official fix or remediation guidance, and no exploits have been reported in the wild.

Successful exploitation could allow an attacker to bypass proper verification of signing time in S/MIME path validation, potentially undermining the authenticity guarantees of signed messages. This could lead to acceptance of malicious or tampered data as valid. The high CVSS score reflects the potential for significant impact on data integrity without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when validating S/MIME signatures with affected versions of BC-JAVA. Monitoring vendor communications for updates is recommended.