diff --git a/Ghidra/Framework/Generic/Module.manifest b/Ghidra/Framework/Generic/Module.manifest
index f2d5499ce4..ed3d3d1e7a 100644
--- a/Ghidra/Framework/Generic/Module.manifest
+++ b/Ghidra/Framework/Generic/Module.manifest
@@ -10,6 +10,6 @@ MODULE FILE LICENSE: lib/commons-lang3-3.20.0.jar Apache License 2.0
 MODULE FILE LICENSE: lib/commons-io-2.19.0.jar Apache License 2.0
 MODULE FILE LICENSE: lib/commons-text-1.10.0.jar Apache License 2.0
 MODULE FILE LICENSE: lib/gson-2.13.2.jar Apache License 2.0
-MODULE FILE LICENSE: lib/bcpkix-jdk18on-1.84.jar Bouncy Castle License
-MODULE FILE LICENSE: lib/bcprov-jdk18on-1.84.jar Bouncy Castle License
-MODULE FILE LICENSE: lib/bcutil-jdk18on-1.84.jar Bouncy Castle License
+MODULE FILE LICENSE: lib/bcpkix-jdk18on-1.86.jar Bouncy Castle License
+MODULE FILE LICENSE: lib/bcprov-jdk18on-1.86.jar Bouncy Castle License
+MODULE FILE LICENSE: lib/bcutil-jdk18on-1.86.jar Bouncy Castle License
diff --git a/Ghidra/Framework/Generic/build.gradle b/Ghidra/Framework/Generic/build.gradle
index 21de831696..bb641673aa 100644
--- a/Ghidra/Framework/Generic/build.gradle
+++ b/Ghidra/Framework/Generic/build.gradle
@@ -43,9 +43,9 @@ dependencies {
 	api "org.apache.commons:commons-text:1.10.0"
 	api "commons-io:commons-io:2.19.0"	
 	api "com.google.code.gson:gson:2.13.2"
-	api "org.bouncycastle:bcpkix-jdk18on:1.84" // requires bcutil and bcprov
-	api "org.bouncycastle:bcprov-jdk18on:1.84"
-	api "org.bouncycastle:bcutil-jdk18on:1.84"
+	api "org.bouncycastle:bcpkix-jdk18on:1.86" // requires bcutil and bcprov
+	api "org.bouncycastle:bcprov-jdk18on:1.86"
+	api "org.bouncycastle:bcutil-jdk18on:1.86"
 
 	compileOnly "junit:junit:4.13.2"
 	compileOnly "org.hamcrest:hamcrest:2.2"
diff --git a/Ghidra/Framework/Generic/src/main/java/ghidra/net/PKIUtils.java b/Ghidra/Framework/Generic/src/main/java/ghidra/net/PKIUtils.java
index 1e4ff0ce4b..5132556e2d 100644
--- a/Ghidra/Framework/Generic/src/main/java/ghidra/net/PKIUtils.java
+++ b/Ghidra/Framework/Generic/src/main/java/ghidra/net/PKIUtils.java
@@ -511,18 +511,24 @@ public class PKIUtils {
 				try {
 					pemObject = reader.readPemObject();
 				}
-				catch (DecoderException e) {
-					// Base64 decoding failure is reported by BouncyCastle as an unchecked
-					// exception.  The offending block has already been consumed through its end
-					// marker, so reading is able to continue with the block which follows it.
-					++blockNumber;
-					String msg = "Invalid PEM certificate data within " + pemFile.getName() + ": " +
-						e.getMessage();
-					if (unusableBlockConsumer == null) {
-						throw new CertificateException(msg);
+				catch (IOException e) {
+					if (e.getCause() instanceof DecoderException ||
+						e.getMessage().contains("malformed")) {
+						// Base64 decoding failure is reported by BouncyCastle as an IOException
+						// (although checking cause or message for malformed entry is needed).
+						// The offending block has already been consumed through its end
+						// marker, so reading is able to continue with the block which follows it.
+						++blockNumber;
+						String msg =
+							"Invalid PEM certificate data within " + pemFile.getName() + ": " +
+								e.getMessage();
+						if (unusableBlockConsumer == null) {
+							throw new CertificateException(msg);
+						}
+						unusableBlockConsumer.accept(msg + " (PEM block " + blockNumber + ")");
+						continue;
 					}
-					unusableBlockConsumer.accept(msg + " (PEM block " + blockNumber + ")");
-					continue;
+					throw e;
 				}
 				if (pemObject == null) {
 					break;		// end of file