CVE-2026-87733
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In the mirage-crypto-ec package before version 2.2.0 for OCaml, the ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With such a public key, signatures can be forged without a private key.
Risk Assessment
The risk includes the possibility of forging digital signatures, which could lead to breaches of integrity and authenticity in systems using this library.
Recommendation
Update the mirage-crypto-ec package to version 2.2.0 or later, which includes a fix preventing acceptance of the point at infinity as a public key.
Other vulnerabilities in mirage-crypto-ec
See all- CVE-2026-87737Medium
In the mirage-crypto-ec package before version 2.4.0 for OCaml, a timing side channel was discovered in NIST elliptic-curve scalar multiplication: the time required for a lookup can depend on a secret. This could allow an attacker to recover private keys through timing measurements.
- CVE-2026-87736Medium
In the mirage-crypto-ec package before version 2.3.0 for OCaml, an out-of-bounds read was discovered for compressed EC public key points. This could lead to data disclosure or program crash.
Original NVD description (English source)
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS