In Bouncy Castle for Java versions prior to 1.86, the high-level OpenPGP API improperly validates data signatures from signing subkeys whose Subkey Binding signatures omit an embedded Primary Key Binding signature and Key Flags subpacket. According to RFC 9580, such embedded signatures are mandatory for subkeys capable of signing. The vulnerability arises because the API's isSigningKey() method inherits signing capability from the primary key when the subkey's binding signature omits Key Flags, while the verifyEmbeddedPrimaryKeyBinding() method does not enforce the embedded signature requirement, leading to a subkey being treated as signing-capable without proper cross-certification. An attacker can exploit this by binding a victim's public signing subkey to their own primary key with a crafted Subkey Binding signature lacking the required embedded Primary Key Binding signature and Key Flags. This results in a relying party accepting a genuine signature as valid but attributing it to the attacker's certificate and identity, causing signature misattribution rather than forgery. The low-level PGPSignature/PGPPublicKeyRing API is not affected. The fix in version 1.86 ensures that subkeys without the required embedded Primary Key Binding signature and Key Flags are not treated as signing-capable.

This vulnerability allows an attacker to cause misattribution of genuine OpenPGP signatures by binding a victim's public signing subkey to an attacker-controlled primary key without the required embedded Primary Key Binding signature. As a result, relying parties may incorrectly validate a genuine signature but associate it with the attacker's identity, potentially undermining trust in signature verification. No private key material is exposed or recovered, and no signature forgery occurs. The impact is limited to incorrect signature attribution.

A fix is available in Bouncy Castle for Java version 1.86 that corrects the validation logic to require the embedded Primary Key Binding signature and Key Flags in Subkey Binding signatures. Users should upgrade to version 1.86 or later to remediate this vulnerability. No other mitigations are indicated by the vendor advisory.