The vulnerability arises from the KeyTransRecipientInformation.UnwrapKey method in bc-csharp versions before 2.7.0. When decrypting CMS EnvelopedData messages using RSA PKCS#1 v1.5 padding, the library rejects ciphertexts with invalid padding by throwing a distinct "bad padding in message." CmsException instead of replacing the key with a random value. This discrepancy allows a remote attacker, who can submit many modified ciphertexts and observe decryption error differences, to recover the content-encryption key via a Bleichenbacher-style adaptive chosen-ciphertext attack.

An unauthenticated remote attacker who has captured a CMS EnvelopedData message can exploit this vulnerability to recover the content-encryption key and thus decrypt the protected content. This compromises the confidentiality of the encrypted data. The attack requires the ability to submit many modified ciphertexts to the decryption application and observe distinct error responses.

A fixed version 2.7.0 of bc-csharp is available that addresses this vulnerability. Users should upgrade to version 2.7.0 or later to remediate the issue. No other mitigation guidance is provided, and no indication exists that the vulnerability is mitigated without applying the fix.