CVE-2026-59641: S/MIME validator trusts signer-asserted signingTime for path validation

Affects Bouncy Castle for Java FIPS (BC-FJA) bcmail-fips before 1.0.7 (1.0.X series), 2.0.7 (2.0.X series) and 2.1.7 (2.1.X series). The S/MIME validator takes the signingTime signed attribute and uses it as the validation date for certificate expiry and CRL checks. Because the signer chooses that timestamp, and it is never compared against the current time nor required to come from an RFC 3161 token, an instant before the revocation date downgrades revocation to a notification rather than an error. An attacker holding an expired or revoked key can back-date signatures and have them reported as valid.