The vulnerability exists in the CMS RSA PKCS#1 v1.5 key-transport unwrap function (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp versions prior to 2.7.0. When decrypting a CMS EnvelopedData message, if the RSA private key unwrap operation encounters invalid PKCS#1 v1.5 padding, it throws a distinct "bad padding in message." CmsException instead of replacing the key with a random value. This difference in error messages allows a remote attacker, who can submit many modified ciphertexts to the decryption application and observe the failure mode, to perform a Bleichenbacher-style adaptive chosen-ciphertext attack to recover the content-encryption key and thus decrypt the message content.

An attacker who has captured a CMS EnvelopedData message and can interact with the decryption service to submit multiple modified ciphertexts can exploit this vulnerability to recover the content-encryption key. This compromises the confidentiality of the encrypted message content. The vulnerability does not require privileges or user interaction but does require the ability to submit ciphertexts and observe distinct error responses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications should avoid revealing distinct error messages that differentiate padding errors from other decryption failures during RSA PKCS#1 v1.5 unwrap operations. Implementing uniform error handling to prevent attackers from distinguishing error types can mitigate the risk of this adaptive chosen-ciphertext attack.