🛡️ CVE-2025-9340 — bc-fips

How this vulnerability can be exploited

This issue can be reached with physical access to the device, attack complexity is low, an attacker needs low-level privileges on the target. A user must actively cooperate. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability none.

CVSS metrics in full

The score comes from this vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:X/RE:M/U:Green

• Attack vector: Physical — the attacker has to touch the device.
• Attack complexity: Low — the attack works reliably, with no preparation.
• Attack requirements: Present — the target has to be in a particular state for the attack to work.
• Privileges required: Low — an ordinary user account is enough.
• User interaction: Active — the victim has to cooperate with the attack.
• Confidentiality impact: None.
• Integrity impact: None.
• Availability impact: None.

Weakness class

CVE-2025-9340 is classified as CWE-787: Out-of-bounds Write. Data is written past the end or before the start of a buffer, corrupting whatever is stored there.

Affected software

CVE-2025-9340 is recorded against 2 packages.

• org.bouncycastle:bc-fips (from 2.1.0 up to 2.1.1)
• unknown

Timeline and source

Published on 22 August 2025. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

nvd.nist.gov (Advisory)
github.com (Package)
github.com (Web)

Other advisories for this package

org.bouncycastle:bc-fips has other advisories on record. If you are patching this one, these are worth checking on the same host:

• ROOT-APP-MAVEN-CVE-2024-29857 (5.0 Medium, published 4 Aug 2026)
• ROOT-APP-MAVEN-CVE-2025-8885 (5.0 Medium, published 15 Jul 2026)
• CVE-2025-12194 (published 25 Oct 2025)
• CVE-2025-9341 (published 22 Aug 2025)
• CVE-2025-9092 (2.0 Low, published 16 Aug 2025)
• CVE-2025-8885 (published 12 Aug 2025)
• CVE-2024-29857 (published 14 May 2024)
• CVE-2022-45146 (published 21 Nov 2022)

Same weakness in other software

These advisories are the same class of weakness (CWE-787: Out-of-bounds Write) in other software:

• CVE-2018-5268 (published 9 Jul 2026)
• CVE-2017-12606 (8.0 High, published 9 Jul 2026)
• CVE-2019-5063 (8.0 High, published 9 Jul 2026)
• CVE-2017-12605 (8.0 High, published 9 Jul 2026)
• CVE-2022-29208 (8.0 High, published 9 Jul 2026)
• CVE-2022-23561 (8.0 High, published 9 Jul 2026)
• CVE-2019-9423 (8.0 High, published 9 Jul 2026)
• CVE-2017-12603 (8.0 High, published 2 Jul 2026)

Details

Affected Packages

References