This vulnerability (CVE-2026-59650) in BC-JAVA arises from improper input validation (CWE-20) in the MTI/A0 Diffie-Hellman key agreement implementation. Specifically, the exponentiation operation uses a peer value that is not validated, potentially allowing an attacker to influence cryptographic computations. The affected versions are all BC-JAVA releases before 1.85 and LTS releases from 2.73.0 up to but excluding 2.73.12. The CVSS 4.0 vector indicates the vulnerability is remotely exploitable over the network without authentication or user interaction, with high impact on confidentiality and integrity. The vendor has not yet provided an official fix or remediation level, and no exploits are currently known in the wild.

Successful exploitation could compromise the cryptographic key agreement process, potentially allowing attackers to undermine the confidentiality and integrity of communications relying on the affected BC-JAVA library versions. Given the high CVSS score and the nature of the flaw, this could lead to severe security breaches in applications using the vulnerable versions for cryptographic operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding the use of affected versions (<1.85 and >=2.73.0 <2.73.12) for critical cryptographic operations or apply any recommended temporary mitigations from the vendor. Monitor official Bouncy Castle communications for updates.