CVE-2026-87733: 
Linux Debian Analisi e mitigazione delle vulnerabilità

CVE-2026-87733 is an ECDSA signature forgery vulnerability in the mirage-crypto-ec library for OCaml, affecting all versions before 2.2.0. The flaw allows an attacker to forge valid ECDSA signatures without possessing a private key by exploiting improper validation of public key inputs. It was published on September 9, 2026, and carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory).

The root cause is improper validation of elliptic curve public keys (CWE-295). Specifically, the ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets fail to reject 0x00 — the byte encoding of the point at infinity — as an invalid public key. Because the point at infinity is a degenerate element of the elliptic curve group, accepting it as a valid public key breaks the mathematical assumptions underlying ECDSA verification, enabling an attacker to construct signatures that pass verification without knowledge of any private key. No special privileges or user interaction are required to exploit this flaw locally (GitHub Advisory).

Successful exploitation allows an unauthenticated local attacker to forge ECDSA signatures across all three supported curves (P-256, P-384, P-521), completely undermining the integrity guarantees provided by the affected library. Any application relying on mirage-crypto-ec for signature verification — such as TLS certificate validation, code signing, or authentication token verification — could be deceived into accepting forged signatures as legitimate. There is no confidentiality or availability impact, but the integrity impact is rated High (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported.

1. Identify target: Locate an application using mirage-crypto-ec versions before 2.2.0 for OCaml that performs ECDSA signature verification (e.g., a TLS stack, authentication service, or code signing verifier).
2. Craft malicious public key: Prepare a public key encoded as 0x00 (the single-byte encoding of the point at infinity on the target elliptic curve — P-256, P-384, or P-521).
3. Submit public key: Supply this 0x00 public key to the target application's signature verification routine via pub_of_octets, which incorrectly accepts it as valid.
4. Forge signature: Construct an arbitrary ECDSA signature value. Because the point at infinity is a degenerate group element, the verification equation is trivially satisfied regardless of the signature bytes.
5. Pass verification: Submit the forged signature alongside the 0x00 public key to the vulnerable verifier, which accepts the signature as valid, achieving authentication bypass or code signing bypass (GitHub Advisory).

Upgrade mirage-crypto-ec to version 2.2.0 or later, which rejects 0x00 (the point at infinity) as an invalid public key in all ECDSA functions (GitHub Advisory). As a temporary workaround prior to patching, applications should implement additional input validation to explicitly reject any public key encoded as 0x00 before passing it to the library. Additionally, review any previously accepted signatures validated by the affected ECDSA implementations (P-256, P-384, P-521) for potential forgeries.