← Vulnerability feed

Vulnerability record · CVE-2026-28364 · published 27 February 2026

CVE-2026-28364: Ocaml out-of-bounds read vulnerability

Ocaml · Ocaml

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.

7.8 CVSS 3.1 High EPSS 0.32% · top 77.1% CWE-126 · CWE-126CWE-125 · Out-of-bounds read
7.8CVSS 3.1 base score
0.32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References
15 Jul 2026Last modified by NVD

Description

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json Vendor Advisory
https://osv.dev/vulnerability/OSEC-2026-01 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-28364
https://bugzilla.redhat.com/show_bug.cgi?id=2443348
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.json

Track CVE-2026-28364 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-9838Ocaml integer overflow vulnerabilityThe caml_ba_deserialize function in byterun/bigarray.c in the standard library in OCaml 4.06.0 has an integer overflow which, in situations where mar…EPSS 4.1%9.8CVE-2017-9772Ocaml vulnerabilityInsufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries mark…EPSS 3.5%9.1CVE-2015-8869Fedoraproject fedora memory buffer overflow vulnerabilityOCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive in…EPSS 5.3%7.8CVE-2017-9779Ocaml vulnerabilityOCaml compiler allows attackers to have unspecified impact via unknown vectors, a similar issue to CVE-2017-9772 "but with much less impact."EPSS 0.58%5.1CVE-2026-34353Ocaml integer overflow vulnerabilityIn OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.EPSS 0.15%

Source: NIST National Vulnerability Database (record CVE-2026-28364), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.