CVE-2026-12852

HighCVSS 7.5/10Last modified Oct 23, 2026

Description

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-789

Affected software

No affected versions have been published.

Timeline

Published
Aug 3, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-128535.4The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugCVE-2026-128558.2Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP proCVE-2026-128568.8A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trustsCVE-2026-128588.5Improper Privilege Management vulnerability in ESET AV Remover (standalone) allows Privilege Escalation via especially crafted RPC.CVE-2026-128596.5Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly CVE-2026-12866.5CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote cCVE-2026-128605.3In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects BouncCVE-2026-128625.1Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise CVE-2026-128635.1An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.CVE-2026-128657.1The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attributCVE-2026-128669.8All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScrCVE-2026-128696.1The Header Footer Builder for Elementor WordPress plugin before 1.2.1 does not require an administrative capability for its dashboard templa
CVE-2026-12852: High severity, CVSS 7.5 | Vulnix