Out-of-Bounds Read Vulnerability in Mirage-Crypto-EC Package for OCaml
CVE-2026-87736

4.3MEDIUM

Key Information:

Vendor

Ocaml

Status
Mirage-crypto-ec
Vendor
CVE Published:
9 September 2026

What is CVE-2026-87736?

An issue has been found in the mirage-crypto-ec package prior to version 2.3.0 for OCaml, where an out-of-bounds read can occur when handling compressed points of EC public keys. This can potentially lead to memory access violations, exposing sensitive data or causing unpredictable behavior in applications that rely on this package.

Affected Version(s)

mirage-crypto-ec 0 < 2.3.0

References

https://osv.dev/vulnerability/OSEC-2026-15

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.