CVE-2026-87733 in mirage-crypto-ec
Summary
by MITRE • 09/09/2026
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in mirage-crypto-ec versions prior to 2.2.0 represents a critical failure in input validation within elliptic curve digital signature algorithm implementations. Specifically, the functions responsible for processing public keys from octet strings, namely Dsa.pub_of_octets for P256, P384, and P521 curves, erroneously accept the encoding of the point at infinity as a valid public key. In standard elliptic curve cryptography, the point at infinity serves as the additive identity element. It is not intended to be used as a public key in signature verification processes because it lacks the necessary mathematical properties required for secure authentication and integrity checks. By accepting this invalid input, the library creates a scenario where the cryptographic primitives operate outside their designed security boundaries, leading to catastrophic failures in trust mechanisms that rely on these curves.
The operational impact of this flaw is severe, as it allows an attacker to forge digital signatures without possessing the corresponding private key. When verifying a signature against a public key set to the point at infinity, the mathematical verification equation collapses or behaves unpredictably depending on the specific implementation details, often resulting in a false positive acceptance of invalid signatures. This effectively breaks the core security guarantees provided by ECDSA, which are non-repudiation and authenticity. An adversary can generate arbitrary messages with valid-looking signature components that will be accepted as authentic by any system relying on this vulnerable version of mirage-crypto-ec for verification. This undermines the integrity of all applications using these cryptographic functions for authentication, secure messaging, or transaction validation.
From a classification perspective, this vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-347 Improper Verification of Cryptographic Signature. The root cause lies in the failure to validate that the decoded public key point is not the identity element before proceeding with cryptographic operations. This oversight violates fundamental principles outlined in industry standards such as NIST SP 800-56A, which mandates rigorous validation of elliptic curve points during key import and verification processes. Furthermore, this flaw can be leveraged within attack scenarios described by MITRE ATT&CK techniques related to signature forgery or bypassing authentication mechanisms, allowing attackers to impersonate legitimate entities or tamper with data without detection.
Mitigation for this vulnerability requires an immediate upgrade of the mirage-crypto-ec library to version 2.2.0 or later, where the input validation logic has been corrected to reject the point at infinity as a public key. For systems that cannot immediately update dependencies, developers should implement additional checks in their application layer to ensure that any decoded elliptic curve points are validated against being the identity element before passing them to cryptographic functions. It is also advisable to audit codebases for other instances where raw octet strings are converted into cryptographic keys without sufficient validation of point validity and order. Regular security assessments and static analysis tools configured with rules targeting improper input validation in crypto libraries can help identify similar weaknesses in future development cycles, ensuring robust adherence to established cryptographic standards.