Skip to main content
CVE-2026-87736VulnerabilityPublished 09/09/2026Updated 09/14/2026

CVE-2026-87736: CWE-125 Out-of-bounds Read in OCaml mirage-crypto-ec

Affects OCaml mirage-crypto-ecSource CVE Database V5

CVSS 3.1 base score
4.3Medium
Exploitation

Not in CISA KEV, no exploitation reported

EPSS
0.4% chance of exploitation in 30 days – higher than 28% of CVEs
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

What to do

AI-suggested

Users should upgrade to mirage-crypto-ec version 2.3.0 or later where this issue is fixed. Since no official patch links are provided, confirm the availability of the fix from the vendor or package repository before upgrading. No other mitigations are indicated.

Affected software

ProductAffectedFixed in
OCamlmirage-crypto-ecAffected
  • >=0 <2.3.0
Fixed in
  • 2.3.0

Description

CVE-2026-87736 is a medium severity vulnerability in the mirage-crypto-ec package for OCaml. It involves an out-of-bounds read when processing compressed elliptic curve public keys. This flaw affects versions prior to 2.3.0 and can cause a denial of service due to application crashes but does not impact confidentiality or integrity.

Weaknesses

References