CVE-2026-63574 describes a memory allocation vulnerability in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket and UserAttributeSubpacketsParser.ReadPacket) in Legion of the Bouncy Castle Inc. bc-csharp versions before 2.7.0. The vulnerability occurs because the parser uses a declared length from a crafted subpacket header to size the subpacket buffer without any upper bound or validation against the enclosing subpacket or packet size. This can allow a remote, unauthenticated attacker who supplies a malicious OpenPGP public key, certificate, or signature to trigger a large memory allocation (up to approximately 2 GB) before any subpacket data is read, resulting in denial of service due to memory exhaustion or an OutOfMemoryException.

An attacker can remotely cause a denial of service condition by triggering excessive memory allocation during parsing of crafted OpenPGP data. This can crash or severely degrade the availability of applications using vulnerable versions of bc-csharp when processing malicious OpenPGP signatures or certificates.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor for official updates from Legion of the Bouncy Castle Inc. and apply any patches or updates addressing this issue once available. Until then, consider restricting or validating untrusted OpenPGP inputs to mitigate potential denial of service.