CVE-2026-87732: OCaml mirage-crypto Information Disclosure

CVE-2026-87732 Overview

CVE-2026-87732 affects the mirage-crypto package for OCaml before version 2.2.0. The vulnerability resides in the AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions. These Authenticated Encryption with Associated Data (AEAD) routines write decrypted plaintext into a caller-provided buffer before verifying the authentication tag. When tag verification fails on forged ciphertext, the functions return false, but the destination buffer already contains the full plaintext. This violates the atomicity contract of AEAD decryption and maps to [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
Applications that trust the boolean return value alone may operate on attacker-influenced plaintext, breaking the integrity guarantees of AEAD.

Affected Products

mirage-crypto package for OCaml, all versions before 2.2.0
Applications calling AES.GCM.authenticate_decrypt_into
Applications calling Chacha20.authenticate_decrypt_into

Discovery Timeline

2026-09-09 - CVE-2026-87732 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87732

Vulnerability Analysis

AEAD constructions such as AES-GCM and ChaCha20-Poly1305 require that decrypted plaintext never be released to the caller unless the authentication tag validates. This property is often called "Encrypt-then-MAC" enforcement or "atomic AEAD." The affected mirage-crypto functions decrypt directly into the caller's buffer and only afterward compare the computed tag against the received tag.

On tag mismatch, the function returns false, signaling failure. However, the destination buffer already contains unauthenticated plaintext derived from the attacker-controlled ciphertext. Callers that neglect to zero the buffer, or that speculatively process it before checking the return value, expose themselves to forged plaintext.

This condition can be leveraged as a decryption oracle in some protocol contexts, and it undermines the integrity guarantees that AEAD is meant to provide.

Root Cause

The root cause is an ordering flaw: plaintext materialization precedes tag verification, and the destination buffer is not scrubbed on failure. The _into variants were introduced to avoid allocation, but this optimization removed the natural quarantine that occurs when a rejected plaintext is discarded with its temporary buffer.

Attack Vector

Exploitation requires an attacker capable of supplying ciphertext to a vulnerable caller. The attack vector is local, and no privileges or user interaction are required. The attacker forges a ciphertext with an invalid tag and submits it to a routine that calls the vulnerable authenticate_decrypt_into API. If the calling application inspects, forwards, or logs the destination buffer without first checking the boolean return, the attacker-controlled plaintext influences downstream logic. Confidentiality is not directly impacted, but integrity of processed data is compromised.

Refer to the OSV Vulnerability OSEC-2026-12 advisory for reproduction details.

Detection Methods for CVE-2026-87732

Indicators of Compromise

Application logs showing AEAD decryption failures immediately followed by processing of the target buffer
Anomalous downstream parsing errors or malformed message handling in services using mirage-crypto
Presence of mirage-crypto versions earlier than 2.2.0 in opam dependency manifests

Detection Strategies

Inventory OCaml projects and audit opam.lock or dune-project files for mirage-crypto versions below 2.2.0
Perform source-level code review to identify call sites of authenticate_decrypt_into variants and confirm the return value is checked before buffer use
Add static analysis rules that flag any read of the destination buffer that is not gated behind a truthy return check

Monitoring Recommendations

Instrument AEAD decryption call sites to emit telemetry on tag verification failures
Alert on repeated decryption failures from a single peer, which may indicate ciphertext forgery attempts
Correlate cryptographic failure events with subsequent parsing anomalies in downstream components

How to Mitigate CVE-2026-87732

Immediate Actions Required

Upgrade mirage-crypto to version 2.2.0 or later across all OCaml projects
Audit application code to ensure the return value of authenticate_decrypt_into is checked before the destination buffer is read
Explicitly zero the destination buffer when tag verification returns false

Patch Information

The maintainers fixed the issue in mirage-crypto 2.2.0. The corrected implementation ensures the destination buffer is not left populated with unauthenticated plaintext when tag verification fails. Consult the OSV Vulnerability OSEC-2026-12 advisory for upstream commit references.

Workarounds

Wrap calls to the vulnerable functions and unconditionally zero the destination buffer on a false return
Switch to the allocating authenticate_decrypt variants that return None on tag failure and never expose forged plaintext
Enforce constant handling of the return value through code review and linters until the upgrade is deployed

bash

# Upgrade mirage-crypto to a patched release
opam update
opam install 'mirage-crypto>=2.2.0'
opam list mirage-crypto