CVE-2026-28364
HighCVSS 7.9Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Risk Assessment
The organization is at risk of remote code execution via crafted Marshal data. An attacker can exploit this vulnerability to execute arbitrary code in the context of the OCaml application, potentially compromising data confidentiality, integrity, and availability.
Recommendation
Immediately upgrade OCaml to version 4.14.3 or later (for the 4.x branch) and to version 5.4.1 or later (for the 5.x branch). As a temporary measure, restrict Marshal deserialization to trusted sources only.
Other vulnerabilities in OCaml
Original NVD description (English source)
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.