CVE-2026-15997
Native ARM SHA3 / SHAKE `restoreFullState` fails to detect size_t underflow in a crafted encoded state
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Out-of-bounds write vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM allows Overflow Buffers. This vulnerability is associated with program files https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/shake.C, https://github.Com/bcgit/bc-lts-java/blob/main/native_c/arm/sha/sha3.C. This issue affects BC-LTS: from 2.73.0 before 2.73.12.1. Issue is only applicable if application involved is accepting memoable SHA3 / SHAKE states from potentially untrusted sources.
| CWE | CWE-787 |
| Vendor | legion of the bouncy castle inc. |
| Product | bc-lts |
| Published | Jul 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for legion of the bouncy castle inc. bc-lts
Be the first to know when new unknown vulnerabilities affecting legion of the bouncy castle inc. bc-lts are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Legion of the Bouncy Castle Inc. / BC-LTS
2.73.0 < 2.73.12.1