CVE-2026-87733
Deferred Deferred - Pending Action

ECDSA Signature Forgery in OCaml Mirage Crypto EC

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: MITRE

Description
An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-09
Last Modified
2026-09-09
Generated
2026-09-29
AI Q&A
2026-09-09
EPSS Evaluated
2026-09-27
NVD
CVE-2026-87733
EUVD
EUVD-2026-74619

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mirage mirage-crypto-ec to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the mirage-crypto-ec library in OCaml before version 2.2.0. It involves the ECDSA functions for curves P256, P384, and P521. These functions incorrectly accept the point at infinity (encoded as 0x00) as a valid public key. An attacker can exploit this to forge signatures without needing a private key.

Detection Guidance

This vulnerability affects the mirage-crypto-ec library in OCaml before version 2.2.0. Detection requires checking the installed version of mirage-crypto-ec. Use the command 'opam list mirage-crypto-ec' to verify the version. If the version is below 2.2.0, the system is vulnerable.

Impact Analysis

If you use the affected OCaml library, an attacker could forge digital signatures, potentially allowing unauthorized actions or data tampering. This could compromise the integrity of cryptographic operations in your applications.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by undermining data integrity and authenticity. Forged signatures may violate requirements for secure authentication and data protection in regulated environments.

Mitigation Strategies

Update the mirage-crypto-ec library to version 2.2.0 or later to address the ECDSA public key validation issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87733. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart