Buffer Over-Read Vulnerability in OCaml Products by OCaml Software

CVE-2026-28364

What is CVE-2026-28364?

A buffer over-read vulnerability exists in OCaml versions prior to 4.14.3 and 5.x versions before 5.4.1, specifically within the Marshal deserialization process. This weakness results from inadequate bounds checking in the readblock() function, leading to unbounded memcpy() operations that can be exploited by attackers through a carefully crafted dataset. Successfully executing an attack can enable remote code execution, making it essential for users to apply appropriate security patches.

References