PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-87736 OCaml CVE debrief

A vulnerability was discovered in the mirage-crypto-ec package before version 2.3.0 for OCaml, which allows for an EC public key out-of-bounds read for compressed points. This issue has a CVSS score of 4.3 and is classified as MEDIUM severity. The vulnerability affects systems using the mirage-crypto-ec package, and defenders should assess the potential impact on their systems. The CVE record and NVD entry provide limited information about the vulnerability, and additional details may be necessary to fully understand the issue.

Vendor
OCaml
Product
mirage-crypto-ec
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-09
Original CVE updated
2026-09-14
Advisory published
2026-09-09
Advisory updated
2026-09-14

Who should care

Defenders responsible for OCaml systems using the mirage-crypto-ec package should assess the potential impact of this vulnerability. They should verify the version of mirage-crypto-ec in use and consider upgrading to version 2.3.0 or later. Additionally, defenders should review system configurations and assess the potential impact on their systems due to the EC public key out-of-bounds read vulnerability. This may be

Why it matters

Defenders should prioritize verifying the version of mirage-crypto-ec in use and assessing the potential impact on their systems due to the EC public key out-of-bounds read vulnerability.

  • Verification of mirage-crypto-ec version is necessary to determine potential exposure
  • Assessment of system configurations and potential impact is required

Technical summary

The mirage-crypto-ec package before version 2.3.0 for OCaml has an EC public key out-of-bounds read for compressed points. This vulnerability can potentially allow attackers to access sensitive information. Defenders should prioritize verifying the version of mirage-crypto-ec in use and assessing the potential impact on their systems. The vulnerability is classified as MEDIUM severity with a CVSS score of 4.3.

Defensive priority

Defenders should prioritize verifying the version of mirage-crypto-ec in use and assessing the potential impact on their systems.

Recommended defensive actions

  • Verify the version of mirage-crypto-ec in use
  • Assess the potential impact on systems
  • Consider upgrading to version 2.3.0 or later

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, and additional details may be necessary to fully understand the issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-87736 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-87736

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-87736 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-87736

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.