The vulnerability (CVE-2026-63575) exists in the PKCS#12 key derivation function (Pkcs12ParametersGenerator) of Legion of the Bouncy Castle Inc.'s bc-csharp library versions prior to 2.7.0. The flaw is a loop with an unreachable exit condition when the iteration count parameter is zero or negative. Instead of terminating, the loop counter wraps around and causes the function to perform roughly 4 billion iterations, leading to CPU exhaustion and denial of service. This can be triggered by an attacker who can supply a crafted PKCS#12 (PFX) file or PKCS#8 encrypted private key using the affected password-based encryption algorithm. The issue impacts the loading process of such files, significantly delaying or halting normal operation.

An attacker able to supply a maliciously crafted PKCS#12 or PKCS#8 encrypted private key file can cause a denial of service condition by exhausting CPU resources. This results in prolonged processing times and potential service unavailability during the key loading operation. There is no indication of confidentiality, integrity, or authentication bypass impacts from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted PKCS#12 or PKCS#8 files with potentially manipulated iteration counts. Monitor for vendor updates regarding a patch or official mitigation.