Skip to content
CVE PROGRAM SOURCE RECORD1.7 Low

CVE-2026-15997

Native ARM SHA3 / SHAKE `restoreFullState` fails to detect size_t underflow in a crafted encoded state

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
bcorg

Description

Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/shake.C, https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/sha3.C. This issue affects BC-LTS: from 2.73.0 before 2.73.12.1. Issue is only applicable if application involved is accepting memoable SHA3 / SHAKE states from potentially untrusted sources.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Legion of the Bouncy Castle Inc. BC-LTS

Default version status: unaffected

  • 2.73.0 to < 2.73.12.1affected

References