CVE-2026-87732: 
Linux Debian Analisi e mitigazione delle vulnerabilità

CVE-2026-87732 is a cryptographic authentication bypass flaw in the mirage-crypto package for OCaml, classified as Improper Verification of Cryptographic Signature (CWE-347). The vulnerability affects all versions of mirage-crypto before 2.2.0 and was published on September 9, 2026. It carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory). The flaw was assigned GHSA-vqxm-cgmv-2pcr and is tracked under EUVD-2026-74618 (GitHub Advisory).

The root cause is a time-of-check/time-of-use ordering flaw in the AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions (CWE-347). Both functions write the fully decrypted plaintext into a caller-supplied buffer before performing the authentication tag comparison. When a forged or invalid tag is detected, the functions correctly return false, but the destination buffer has already been populated with the decrypted plaintext — violating the fundamental AEAD (Authenticated Encryption with Associated Data) guarantee that unauthenticated ciphertext must never be decrypted and exposed. An attacker who can supply crafted ciphertext with a forged tag can cause the application to process or act on unauthenticated plaintext, depending on how the caller handles the return value (GitHub Advisory).

The primary impact is a high integrity violation: unauthenticated plaintext is written to memory buffers even when authentication fails, undermining the security guarantees of AES-GCM and ChaCha20-Poly1305 AEAD constructions. Applications that do not strictly gate further processing on the boolean return value of these functions may inadvertently use, forward, or act upon forged plaintext. This could enable memory corruption or use-after-free conditions depending on how the buffer is subsequently used, and may allow a local attacker to influence application logic or data flows without valid credentials or keys (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, indicating very low near-term exploitation probability. The vulnerability is local in scope (attack vector: Local), requires no privileges, and no user interaction, but its impact is limited to integrity. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify a target application: Locate an OCaml application using mirage-crypto versions before 2.2.0 that calls AES.GCM.authenticate_decrypt_into or Chacha20.authenticate_decrypt_into and does not strictly halt processing when the function returns false.
2. Craft forged ciphertext: Prepare a ciphertext payload with a deliberately invalid or forged authentication tag, targeting the AEAD-protected data channel used by the application.
3. Submit the forged payload: Supply the crafted ciphertext to the vulnerable function via any local interface (IPC, file, shared memory, etc.) that feeds into the affected decrypt function.
4. Observe buffer population: Despite the function returning false (tag mismatch), the caller-provided buffer is filled with the decrypted plaintext derived from the forged ciphertext.
5. Exploit downstream behavior: If the application proceeds to use the buffer contents (e.g., passes them to a parser, memory allocator, or network handler), the attacker can influence application logic, trigger memory corruption, or cause use-after-free conditions depending on the application's buffer management (GitHub Advisory).

The fix is available in mirage-crypto version 2.2.0, which corrects the ordering so that authentication tag verification occurs before any plaintext is written to the caller-provided buffer. All users of mirage-crypto should upgrade to 2.2.0 or later immediately. As a short-term workaround prior to patching, application developers should ensure that any code calling authenticate_decrypt_into strictly checks the return value and clears or discards the destination buffer contents if false is returned, preventing downstream use of unauthenticated plaintext (GitHub Advisory).