The vulnerability (CVE-2026-103600) is due to uncontrolled recursion in the ASN.1 parser implementations Asn1InputStream and Asn1StreamParser in Legion of the Bouncy Castle Inc. bc-csharp versions prior to 2.7.0. When parsing ASN.1 data with deeply nested constructed elements (e.g., SEQUENCE inside SEQUENCE), the parser makes recursive calls without limiting the recursion depth. Approximately 2,000 nested levels (about 8 KB of DER data) can exhaust a 1.5 MB thread stack, causing a StackOverflowException that terminates the entire process. On threads with larger stacks, the parsing time increases quadratically with the nesting depth, potentially causing significant CPU consumption. This affects any code paths that parse untrusted ASN.1 data, including common cryptographic formats and protocols.

A remote unauthenticated attacker can cause a denial of service by triggering a stack overflow in the ASN.1 parser, leading to process termination. This affects applications using the vulnerable bc-csharp library to parse untrusted ASN.1 data such as certificates and cryptographic messages. There is no indication of code execution or data disclosure from this vulnerability. The denial of service impact is high due to the inability of .NET to catch the StackOverflowException and the termination of the entire process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid parsing untrusted ASN.1 data with vulnerable versions of bc-csharp. Monitor vendor communications for updates and apply official patches once released.