This vulnerability (CWE-347) in Bouncy Castle for Java (BC-JAVA) versions prior to 1.85 causes OpenPGP inline-signature policy failures to be silently ignored, meaning that signature verification does not properly enforce policy and may accept invalid signatures. The issue also affects the FIPS-compliant BC-JAVA (BC-FJA) versions before bcpg-fips 2.0.13. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on integrity. No official remediation or patch information is currently provided in the vendor advisory or CVE data.

The vulnerability allows cryptographic signature verification to be bypassed silently, potentially enabling attackers to present forged or invalid signatures that are accepted as valid. This undermines the integrity guarantees of cryptographic operations relying on BC-JAVA's OpenPGP implementation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor the vendor's communications for updates. Until a fix is available, avoid relying on vulnerable versions (=1.81, >=1.81 <1.85) for critical signature verification tasks or consider alternative cryptographic libraries.