CVE-2026-87736
Received Received - Intake

EC Public Key Out-of-Bounds Read in Mirage-Crypto-EC

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: MITRE

Description
An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-09
Last Modified
2026-09-09
Generated
2026-09-09
AI Q&A
2026-09-09
EPSS Evaluated
N/A
NVD
CVE-2026-87736
EUVD
EUVD-2026-74622

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mirage mirage-crypto-ec to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the mirage-crypto-ec package for OCaml before version 2.3.0. It involves an out-of-bounds read when processing compressed elliptic curve (EC) public keys, which could lead to memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the OCaml mirage-crypto-ec library and involves an out-of-bounds read in EC public key handling for compressed points. Detection requires checking the installed version of mirage-crypto-ec. Use 'opam list mirage-crypto-ec' to verify the version. If the version is below 2.3.0, the system is vulnerable.

Impact Analysis

The impact includes potential denial-of-service (DoS) due to crashes, or unauthorized memory access if exploited. It requires local access or user interaction to trigger, limiting remote exploitation.

Mitigation Strategies

Upgrade the mirage-crypto-ec package to version 2.3.0 or later. Use 'opam update' followed by 'opam upgrade mirage-crypto-ec' to apply the fix. If upgrading is not immediately possible, restrict access to systems using this library or monitor for unusual cryptographic operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87736. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart