CVE-2026-87736

Name of the Vulnerable Software and Affected Versions mirage-crypto-ec versions prior to 2.3.0

Description An out-of-bounds read occurs when processing EC public key compressed points. The internal Point.of octets() function lacks a length check for compressed points, causing an exception when a short buffer is provided. This issue affects all NIST curves (P-256, P-384, P-521) and impacts the Dsa.pub of octets() and Dh.key exchange() functions.

Recommendations Update to version 2.3.0.