The vulnerability (CVE-2026-63567) exists in the IesEngine.DecryptBlock method of Legion of the Bouncy Castle Inc. bc-csharp prior to version 2.7.0. When used with a padded block cipher such as AES in CBC mode with PKCS#7 padding, the engine decrypts ciphertext and removes padding before verifying the MAC. This leads to an observable discrepancy in error messages between padding failures and MAC failures, enabling a remote attacker who can submit modified ciphertexts under the same key pair to recover plaintext via a CBC padding-oracle attack. Stream-mode IES is not affected by this issue.

An attacker who has captured an IES or ECIES ciphertext and can submit modified ciphertexts for decryption under the same key pair may recover plaintext data by exploiting the difference in error messages between padding and MAC verification failures. This compromises the confidentiality of encrypted data in affected applications using padded block ciphers with IesEngine.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using IesEngine directly with padded block ciphers such as AES in CBC mode with PKCS#7 padding. Consider using stream-mode IES or alternative cryptographic implementations that do not exhibit this vulnerability.