The vulnerability (CVE-2026-58061) affects Bouncy Castle for Java before version 1.85, as well as Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS versions prior to 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series), and 2.1.3 (2.1.X series). In CCM-family modes, the implementation writes plaintext data to the caller's buffer before performing the authentication tag check. This premature writing can result in exposure of unauthenticated plaintext data if the tag verification fails, violating the expected security guarantees of authenticated encryption. The vulnerability is categorized under CWE-354 (Improper Verification of Cryptographic Signature). No exploits in the wild are currently known.

The vulnerability allows plaintext data to be written to the caller's buffer before the authentication tag is verified, potentially exposing unauthenticated plaintext if the tag check fails. This undermines the integrity and authenticity guarantees of CCM-mode encryption, which could lead to security issues in applications relying on Bouncy Castle for secure communications or data protection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patches or fixes are referenced in the provided data. Users should monitor Bouncy Castle vendor advisories for updates and apply official fixes once available. Until then, avoid using affected versions in security-critical contexts or implement additional application-level checks if feasible.