CVE‐2026‐59642

Title: CMS AuthenticatedData content not bound to MAC when authAttrs present.

Issue affecting: BC before 1.85, BC-LTS before 2.73.12, BC-FJA before bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Fixed versions: BC 1.85, BC-LTS 2.73.12, BC-FJA bcpkix-fips 1.0.12, 2.0.12 and 2.1.12.

Platform affected: Java 8 and later.

In RecipientInformation.getContentStream(), the content is tee'd through an unkeyed digest calculator, and getMac() then MACs only DER(authAttrs). RFC 5652 §9.3 requires the recipient to compare the computed content digest against the messageDigest attribute inside authAttrs, but the library never does this automatically — getContentDigest() merely exposes the value. BC's own test suite and javadoc example compare only ad.getMac() to recipient.getMac(), so callers following the documented pattern never bind the content to the MAC. An attacker who can modify the message in transit can swap encapContentInfo.eContent for arbitrary bytes while leaving authAttrs and mac untouched, and verification still succeeds.

The fix was introduced in commit 2117f316a5a4.