CVE-2026-87736 in mirage-crypto-ec
Summary
by MITRE • 09/09/2026
An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within the mirage-crypto-ec library prior to version 2.3.0 represents a critical flaw in the implementation of Elliptic Curve cryptography, specifically affecting the parsing and validation logic for compressed elliptic curve public keys. This cryptographic library is widely utilized in OCaml-based systems that require secure communication channels or digital signatures, making its integrity paramount for maintaining confidentiality and authenticity across various applications. The specific defect lies in how the software handles input data corresponding to compressed points on an elliptic curve. In standard ECC implementations, a compressed point consists of a single byte indicating the parity of the y-coordinate followed by the x-coordinate bytes. The flaw arises when the library fails to adequately validate the length and structure of this input before attempting to read or process it, leading to an out-of-bounds memory access scenario.
From a technical perspective, this vulnerability is classified as CWE-125, which denotes Out-of-Bounds Read. This type of error occurs when software reads data from a memory location beyond the intended boundary of a buffer. In the context of mirage-crypto-ec, an attacker can craft a maliciously sized compressed public key that appears syntactically valid but contains length fields or coordinate values that exceed the allocated buffer size during processing. When the library attempts to extract coordinates or perform subsequent cryptographic operations based on this malformed input, it accesses memory locations outside the bounds of the designated array or structure. This behavior is not merely a logical error but a direct violation of memory safety principles inherent in lower-level systems programming, even within higher-level languages like OCaml if unsafe primitives are used for low-level byte manipulation.
The operational impact of this vulnerability extends beyond simple data corruption. An out-of-bounds read can lead to the leakage of sensitive information residing in adjacent memory regions. If an attacker controls the input and observes differences in application behavior or timing, they may potentially infer cryptographic keys or other secret values stored nearby in memory. Furthermore, depending on how the error is handled by the runtime environment or subsequent code paths, this flaw could trigger a denial of service condition by causing a segmentation fault or panic within the OCaml garbage collector or the underlying operating system process. In network-facing services that parse public keys from TLS handshakes or certificate chains, an attacker could exploit this to crash the server, resulting in availability loss for legitimate users.
This vulnerability maps directly to several tactics and techniques defined by the MITRE ATT&CK framework. It aligns with T1059, Command and Scripting Interpreter, if exploited within a broader attack chain involving script execution, but more accurately reflects T1203, Exploitation for Client Execution, or general exploitation patterns associated with CWE-125 in network services. The lack of proper input validation is also characteristic of CWE-20, Improper Input Validation, which serves as the root cause allowing the out-of-bounds read to occur. Security analysts should recognize that this flaw highlights the risks associated with manual memory management or unsafe byte-level operations even in managed languages when dealing with cryptographic primitives where precision and boundary checks are non-negotiable.
To mitigate this risk, organizations utilizing mirage-crypto-ec must immediately upgrade to version 2.3.0 or later, where the developers have implemented rigorous bounds checking for compressed point parsing routines. Until an update can be applied, defensive measures should include strict input validation at the network perimeter to reject any public key structures that do not conform strictly to expected length constraints for the specific curve being used. Additionally, enabling core dumps and monitoring for abnormal process terminations in production environments hosting vulnerable instances can aid in detecting potential exploitation attempts. Regular security audits of cryptographic implementations are essential to ensure that such low-level memory safety issues are identified before they reach deployment stages.