CVE-2026-63574

The record

Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeSubpacketsParser.ReadPacket) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote, unauthenticated attacker who can supply a crafted OpenPGP public key, certificate or signature to cause a denial of service (OutOfMemoryException or memory exhaustion in the parsing process) via a subpacket header using the five-octet length form, because the declared length was used to size the subpacket buffer with no upper bound and without being compared with the size of the enclosing subpacket area or packet, so a few bytes of input could demand an allocation of up to about 2 GB before any subpacket data was read.

Affected packages

Related vulnerabilities

• CVE-2026-62297 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-789
• CVE-2026-62254 LibreDWG is a free C library to read and write DWG files. CWE-789
• CVE-2026-61845 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-789
• CVE-2026-115865 Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to… CWE-789
• CVE-2026-119280 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-789
• CVE-2026-119278 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-789
• CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-789
• CVE-2026-118590 A security vulnerability has been detected in nipy nibabel up to 5.4.2. CWE-789