CVE-2026-87732: CWE-347 Improper Verification of Cryptographic Signature in OCaml mirage-crypto

The vulnerability in mirage-crypto (before version 2.2.0) involves improper verification of cryptographic signatures (CWE-347). Specifically, the AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write decrypted plaintext into a caller-provided buffer before checking the authentication tag. If the tag verification fails (indicating a forged tag), the functions return false but do not erase or prevent access to the plaintext already written in the buffer. This behavior can lead to exposure of plaintext data despite failed authentication.

An attacker who provides a forged authentication tag can cause the functions to output decrypted plaintext into the buffer even though the tag verification fails. This can lead to unauthorized disclosure of plaintext data, impacting data integrity and confidentiality. The CVSS score of 6.2 (medium severity) reflects the local attack vector and the lack of confidentiality impact but high integrity impact.

A fix is available in mirage-crypto version 2.2.0 and later. Users should upgrade to version 2.2.0 or newer to ensure that plaintext is not written before tag verification completes successfully. Until then, avoid using affected versions or implement application-level checks to prevent use of decrypted data if authentication fails. Patch status is confirmed by the version boundary in the affectedVersions field.