CVE-2026-87732: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-87732 is a cryptographic integrity flaw in the mirage-crypto package for OCaml, where AEAD decryption functions write plaintext to caller-provided buffers before verifying the authentication tag. This affects AES.GCM.authenticate_decrypt_into, Chacha20.authenticate_decrypt_into, and AES.CCM16.authenticate_decrypt_into in all versions of mirage-crypto before 2.2.0. The vulnerability was published on September 9, 2026, and carries a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory, OSV).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature): the authenticate_decrypt_into functions perform decryption and write the resulting plaintext into the caller's destination buffer before comparing the AEAD authentication tag. When a forged or invalid tag is detected, the functions correctly return false, but the destination buffer already contains the full decrypted plaintext — violating the all-or-nothing semantics that AEAD constructs are designed to guarantee. An attacker must be able to supply a forged ciphertext (with a manipulated tag) to an application using the vulnerable functions; no privileges or user interaction are required, but the attack vector is local. A proof-of-concept OCaml reproduction script is publicly available via the OSV database, demonstrating tag forgery by flipping a single bit and confirming that unverified plaintext leaks into the output buffer (GitHub Advisory, OSV).

Successful exploitation allows a local attacker to obtain decrypted plaintext that should have been rejected due to authentication failure, effectively bypassing the integrity and authenticity guarantees of AES-GCM, ChaCha20-Poly1305, and AES-CCM16. The primary impact is a high integrity violation — applications relying on these functions to reject unauthenticated ciphertext may silently process forged messages. Confidentiality is also indirectly affected, as sensitive plaintext (e.g., cryptographic keys, private messages) may be exposed to callers that do not check the return value before using the buffer contents (GitHub Advisory, OSV).

A proof-of-concept OCaml script is publicly available via the OSV database (OSEC-2026-12), demonstrating the vulnerability by forging an AEAD tag and confirming plaintext leakage into the output buffer. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.077%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and NVD SSVC classifies exploitation status as "poc" with the attack assessed as non-automatable (OSV, GitHub Advisory).

1. Identify a target application: Locate an OCaml application using mirage-crypto versions before 2.2.0 that calls AES.GCM.authenticate_decrypt_into, Chacha20.authenticate_decrypt_into, or AES.CCM16.authenticate_decrypt_into and processes the output buffer without strictly checking the boolean return value.
2. Obtain or intercept a valid ciphertext: Acquire a legitimately encrypted ciphertext (e.g., via network interception or access to stored data) that was encrypted with the target key and nonce.
3. Forge the authentication tag: Modify the authentication tag of the ciphertext — for example, by flipping a single bit — producing a ciphertext with an invalid tag that will cause the function to return false.
4. Submit the forged ciphertext: Provide the forged ciphertext to the target application's decryption routine. The vulnerable authenticate_decrypt_into function will decrypt the ciphertext and write the plaintext into the destination buffer before checking the tag.
5. Read the plaintext from the buffer: Because the function returns false but does not zero or invalidate the destination buffer, any code path that reads from the buffer after a failed authentication check will obtain the full decrypted plaintext, achieving unauthenticated plaintext disclosure (OSV).

The primary remediation is to upgrade mirage-crypto to version 2.2.0 or later, which fixes the ordering of tag verification and plaintext output (GitHub Advisory, OSV). As a short-term workaround, application developers should audit all call sites of authenticate_decrypt_into functions and ensure the boolean return value is checked before the destination buffer is read or passed to any downstream logic — discarding or zeroing the buffer on a false return. Consider replacing authenticate_decrypt_into with the standard authenticate_decrypt variants (which do not expose the buffer on failure) until the library can be upgraded.