CVE‐2026‐12816

Title: IESEngine stream-mode MAC forgery via length-dependent KDF split.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12.

Platform affected: Java 8 and later.

When IESEngine is initialised via the 4-arg init(forEncryption, priv, pub, params) with no block cipher, V is empty and the KDF is seeded only with the static ECDH shared secret Z. The derived keystream is split as K1 (inLen bytes) followed by K2 (MAC key), so K2's offset depends on message length. Because K1 is used as an XOR keystream, C⊕M reveals KDF[0..L], and KDF2BytesGenerator is prefix-stable, so the attacker now knows the MAC key for any message of length L' ≤ L − macKeyBytes. A passive observer with one known plaintext can therefore forge arbitrary authenticated ciphertexts accepted by the recipient, escalating from passive reader to active forger without either private key.

The fix was introduced in commit 6d9e4bbaee94.