The mirage-crypto package versions prior to 2.2.0 for OCaml contain a cryptographic vulnerability (CVE-2026-87732) in the AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions. These functions decrypt data into a buffer provided by the caller and only afterward verify the authentication tag. If the tag verification fails due to a forged tag, the functions return false but do not erase or prevent the plaintext from being present in the buffer. This behavior can lead to exposure of plaintext data despite authentication failure, representing a CWE-347 (Improper Verification of Cryptographic Signature) weakness.

The vulnerability results in the decrypted plaintext being available in the caller's buffer even when the authentication tag is invalid or forged. This can lead to information disclosure if an attacker can access the buffer contents after a failed authentication attempt. There is no impact on confidentiality from successful decryption since the tag verification fails, but the presence of plaintext in memory despite authentication failure is a security concern. The CVSS score is 6.2 (medium severity) with no confidentiality impact but high integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to mirage-crypto version 2.2.0 or later once available, as the issue is described as affecting versions before 2.2.0. Until a patch is applied, avoid using the affected functions in security-critical contexts or ensure that buffers are securely cleared after failed authentication attempts.