BC# .NET CcmBlockCipher Decryption Tag Verification Bypass (CVE-2026-103601)

Vulnerability Overview CVE-2026-103601 is a security vulnerability affecting BC.NET versions 2.6.2 and earlier, as well as the 2.7.0-beta.98 pre-release version. The vulnerability involves the and classes within , which present security issues when handling AES/CCM mode encryption. Impact Scope Affected Versions: BC.NET 2.6.2 and earlier, and the 2.7.0-beta.98 pre-release version. Platform Impact: All CLR platforms. Specific Impacts: - During decryption, if the authentication tag is incorrect, an is thrown; however, the decrypted plaintext is still written to the caller's output buffer. - Decrypting untrusted ciphertext and writing it to the buffer may expose data via the method (using the output array or method) or the overload method of . - Attackers can submit forged or modified ciphertexts and read the decrypted data even if the tag check fails. - The affected code also acts as an unauthenticated CTR decryption oracle, potentially revealing the plaintext of captured messages. Remediation Fixed Version: BC.NET 2.7.0. Remediation Measures: - now checks the tag before decryption and only copies the plaintext to the caller's buffer if the tag is correct. - clears the buffer it wrote to before throwing an . - For users unable to upgrade immediately, it is recommended to clear the buffer when an is thrown (e.g., using ) or to use the and overload methods that return a new array. POC Code No specific POC code was provided on the page; however, links to the fixing commits are provided: Commit 1 Commit 2 Additional Information Discoverer: Claude, the AI assistant from Anthropic. Collaborating Teams: Anthropic Security Team and Anthropic Research.

Goal Reached Thanks to every supporter — we hit 100%!

BC# .NET CcmBlockCipher Decryption Tag Verification Bypass (CVE-2026-103601)

More from this source