CVE-2026-12852
CVE-2026-12852 is a high-severity vulnerability with a CVSS 4.0 base score of 8.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-789.
Key facts
- Severity: High (CVSS 4.0 base score 8.7)
- EPSS exploit prediction: 0% (18th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-789
- Published:
- Last modified:
Description
In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.
Frequently asked questions
- What is CVE-2026-12852?
- In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.
- How severe is CVE-2026-12852?
- CVE-2026-12852 has a CVSS 4.0 base score of 8.7, rated high severity.
- Is CVE-2026-12852 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-12852?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-12852 published?
- CVE-2026-12852 was published on 2026-08-03 and last updated on 2026-08-04.
References
- https://github.com/bcgit/bc-java/commit/a747038bb5bbd5e29fb2b7607ab38af1fd8d1790
- https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902026%E2%80%9012852
Other CWE-789 vulnerabilities
- CVE-2021-34869 — High (CVSS 8.8): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop…
- CVE-2021-34868 — High (CVSS 8.8): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop…
- CVE-2026-69219 — High (CVSS 8.7): The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.…
- CVE-2026-58067 — High (CVSS 8.7): A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause…
- CVE-2026-14682 — High (CVSS 8.7): In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This…
- CVE-2026-58060 — High (CVSS 8.7): In Bouncy Castle for Java before 1.85, HSS public-key level count unbounded, enabling huge allocation on verify. This…