The vulnerability identified as CVE-2026-12852 affects Bouncy Castle for Java versions prior to 1.85. The MLS wire decoder component allocates memory using a length value supplied by an attacker without first verifying that the length is within safe bounds. This can result in excessive memory allocation, potentially causing denial of service conditions. The vulnerability is classified under CWE-789 (Uncontrolled Memory Allocation). There is no explicit patch or remediation information available at this time.

An attacker can cause the affected software to allocate large amounts of memory by specifying an attacker-controlled length value, potentially leading to denial of service due to resource exhaustion. There is no indication of privilege escalation, code execution, or data disclosure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor official Bouncy Castle communications for updates and consider applying any recommended temporary mitigations once disclosed.