PT-2026-88816 · Ocaml+1 · Mirage-Crypto-Ec

CVE-2026-87737

·

Published

2026-08-17

·

Updated

2026-09-09

CVSS v3.1

5.9

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
The scalar multiplication includes pre-computed tables for speedup (introduced in mirage-crypto-ec 0.11.3). The lookup algorithm for these tables performs secret-dependent reads instead of scanning the entire table.

Solution

Instead of using the index n - 1, where n is secret-dependent, use i - 1, as done in the Go reference implementation. If n is 0, there is a out-of-bounds read before the patch.

Timeline

  • 2026-08-12: report by Eric Ebinger to security@ocaml.org
  • 2026-08-17: release of mirage-crypto-ec 2.4.0 and this advisory

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-87737
OSEC-2026-17

Affected Products

Mirage-Crypto-Ec