CVE-2026-87736
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In the mirage-crypto-ec package before version 2.3.0 for OCaml, an out-of-bounds read was discovered for compressed EC public key points. This could lead to data disclosure or program crash.
Risk Assessment
The risk includes potential disclosure of sensitive in-memory data or application crashes, which could affect availability and confidentiality of systems using this library.
Recommendation
Update the mirage-crypto-ec package to version 2.3.0 or later, which includes a fix eliminating the out-of-bounds read.
Other vulnerabilities in mirage-crypto-ec
See all- CVE-2026-87737Medium
In the mirage-crypto-ec package before version 2.4.0 for OCaml, a timing side channel was discovered in NIST elliptic-curve scalar multiplication: the time required for a lookup can depend on a secret. This could allow an attacker to recover private keys through timing measurements.
- CVE-2026-87733Medium
In the mirage-crypto-ec package before version 2.2.0 for OCaml, the ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With such a public key, signatures can be forged without a private key.
Original NVD description (English source)
An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS