Vulnerability record · CVE-2017-9772 · published 23 June 2017

CVE-2017-9772: Ocaml vulnerability

Ocaml · Ocaml

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.

9.8 CVSS 3.0 Critical EPSS 3.5% · top 11.3%

9.8CVSS 3.0 base score, v2 10.0

3.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Ocaml Ocaml

References

Link	Tags
http://www.securityfocus.com/bid/99277	Third Party AdvisoryVDB Entry
https://caml.inria.fr/mantis/view.php?id=7557	Issue TrackingThird Party Advisory
https://security.gentoo.org/glsa/201710-07
https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html	Issue TrackingThird Party Advisory
http://www.securityfocus.com/bid/99277	Third Party AdvisoryVDB Entry
https://caml.inria.fr/mantis/view.php?id=7557	Issue TrackingThird Party Advisory
https://security.gentoo.org/glsa/201710-07
https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html	Issue TrackingThird Party Advisory

Track CVE-2017-9772 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-9838Ocaml integer overflow vulnerabilityThe caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where mar…EPSS 4.1%6 Apr 2018 9.1CVE-2015-8869Fedoraproject fedora memory buffer overflow vulnerabilityOCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive in…EPSS 5.3%13 Jun 2016 7.8CVE-2026-28364Ocaml out-of-bounds read vulnerabilityIn OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a…EPSS 0.32%27 Feb 2026 7.8CVE-2017-9779Ocaml vulnerabilityOCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact."EPSS 0.58%7 Sep 2017 5.1CVE-2026-34353Ocaml integer overflow vulnerabilityIn OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.EPSS 0.15%27 Mar 2026

Source: NIST National Vulnerability Database (record CVE-2017-9772), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.