CVE-2026-28364

Published: Feb 27, 2026Modified: Jul 15, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.

Affected (2)

Products: Ocaml: Ocaml

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Ocaml Ocaml	Before 4.14.3
Ocaml Ocaml	From 5.0.0 to 5.4.1

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Buffer Over-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

References (5)

https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json

Source: cve@mitre.org

Vendor Advisory

https://osv.dev/vulnerability/OSEC-2026-01

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/security/cve/CVE-2026-28364

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2443348

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.