CVE‐2026‐59641

Title: S/MIME validator trusts signer-asserted signingTime for path validation.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bcmail-fips 1.0.7, 2.0.7 and 2.1.7, BC-FJA before bcjmail-fips 1.0.7 (from 1.0.4), 2.0.7 and 2.1.7.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcmail-fips 1.0.7, 2.0.7 and 2.1.7 and bcjmail-fips 1.0.7 (from 1.0.4), 2.0.7 and 2.1.7.

Platform affected: Java 8 and later.

In Bouncy Castle's S/MIME validator, getSignatureTime() returns the CMS signingTime signed attribute and validateSignatures() passes it to PKIXCertPathReviewer via usedParameters.setDate(). Because this timestamp is chosen by the signer, certificate expiry and CRL revocation checks are performed at an attacker-selected instant. If that instant precedes the revocation date, the reviewer emits only a revokedAfterValidation notification rather than an error, so isValidCertPath() and ValidationResult.isValidSignature() both return true. No RFC 3161 timestamp token is required and the asserted time is never compared against the current time, so an attacker holding an expired or revoked key can back-date signatures and have them accepted.

The fix was introduced in commit 2f81b22d559b and commit fd89fe918b37.