CVE-2026-87733: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-87733 is an ECDSA signature forgery vulnerability in the mirage-crypto-ec library for OCaml, affecting all versions before 2.2.0. The flaw allows the {P256,P384,P521}.Dsa.pub_of_octets functions to accept 0x00 — the encoding of the point at infinity — as a valid ECDSA public key, enabling signature forgery without possession of a private key. It was published on September 9, 2026, with a CVSS v3.1 base score of 6.2 (Medium) (GitHub Advisory, OSV).

The root cause is improper validation of elliptic curve public key inputs (CWE-295: Improper Certificate Validation). In ECDSA, the point at infinity is not a valid public key and must be explicitly rejected during key deserialization; however, pub_of_octets in the P256, P384, and P521 DSA modules returns Ok when given the single byte 0x00, bypassing this check. Once an attacker supplies this invalid key to a verification routine, the mathematical properties of the point at infinity cause any signature with an arbitrary r and s=1 to verify successfully, as the verification equation collapses. A complete, runnable OCaml proof-of-concept demonstrating the forgery is publicly available (OSV, GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to forge valid ECDSA signatures for arbitrary messages without knowledge of any private key, resulting in a high integrity impact with no confidentiality or availability loss. Applications relying on mirage-crypto-ec for signature verification — such as those performing PKI operations, certificate validation, authentication token verification, or message integrity checks — are at risk of complete authentication bypass. This primitive can be chained into higher-level attacks including impersonation of legitimate signers, creation of rogue certificates, or bypassing code-signing or data-integrity controls (OSV, GitHub Advisory).

A proof-of-concept OCaml reproduction module is publicly available via OSV (OSEC-2026-13), demonstrating the full forgery flow with high confidence (OSV). There is no evidence of in-the-wild exploitation at this time, and the CVE status is listed as "Deferred" with no CISA KEV catalog entry. The EPSS score is approximately 0.105%, placing it in the 1st percentile for near-term exploitation likelihood. Exploitation does not require authentication or user interaction, though the CVSS attack vector is classified as Local, limiting opportunistic remote exploitation (GitHub Advisory).

1. Identify target: Confirm the target application uses mirage-crypto-ec version < 2.2.0 and calls P256.Dsa.pub_of_octets, P384.Dsa.pub_of_octets, or P521.Dsa.pub_of_octets to load public keys for ECDSA signature verification.
2. Supply the point-at-infinity key: Pass the single byte 0x00 to pub_of_octets. In a vulnerable version, this returns Ok instead of an error, yielding an invalid "public key" representing the point at infinity.
3. Select a target message: Compute the SHA-256 (or appropriate curve hash) of the message to be forged, e.g., Digestif.SHA256.(to_raw_string (digest_string "transfer 1000eur to mallory")).
4. Construct a forged signature: Set r to any non-zero value and s to 1 (encoded as 31 zero bytes followed by 0x01 for P256): let s = String.make 31 '\000' ^ "\001".
5. Verify the forged signature: Call Dsa.verify ~key:o_key (r, s) z — the verification returns true due to the mathematical collapse of the ECDSA verification equation under the point at infinity, confirming successful forgery without any private key (OSV).

• Application Behavior: ECDSA signature verification succeeding for messages where no legitimate private key holder exists; unexpected acceptance of cryptographic operations with a single-byte (0x00) public key input.
• Logs: Application logs showing successful signature verification events for messages or tokens that should not have valid signatures; errors or anomalies in key loading routines that are silently swallowed.
• Code/Dependency Audit: Presence of mirage-crypto-ec versions < 2.2.0 in OCaml project lock files (e.g., opam.lock, dune-project dependencies); use of pub_of_octets without upstream version pinning to ≥ 2.2.0.
• Network: Unexpected or unauthorized signed messages, tokens, or certificates presented to services using mirage-crypto-ec for verification, particularly those with minimal or trivially structured signature values (OSV).

Upgrade mirage-crypto-ec to version 2.2.0 or later, which correctly rejects 0x00 (the point at infinity) as an invalid public key in all affected pub_of_octets functions (GitHub Advisory). As a short-term workaround prior to patching, applications should validate that any public key returned by pub_of_octets is not the point at infinity before using it for signature verification. Additionally, audit all code paths that accept externally supplied public keys to ensure they enforce strict key validation before cryptographic operations.

The vulnerability received automated coverage from vulnerability tracking services including VulDB, CVEFeed, and OSV shortly after publication on September 9, 2026, and was noted on Bluesky via CVE tracking accounts (OSV). No significant vendor statements, named researcher commentary, or broader media coverage has been identified beyond standard database aggregation.