CVE-2026-28364: High severity ocaml OCaml vulnerability
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OCaml runtime/intern.cto a version that resolves this vulnerability.Fixed in 4.14.3 - Upgrade
Upgrade
OCaml runtime/intern.cto a version that resolves this vulnerability.Fixed in 5.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28364?
CVE-2026-28364 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-28364?
To fix CVE-2026-28364, upgrade to OCaml version 4.14.3 or 5.4.1 or later.
What type of vulnerability is CVE-2026-28364?
CVE-2026-28364 is a buffer over-read vulnerability found in the Marshal deserialization process.
What software versions are affected by CVE-2026-28364?
CVE-2026-28364 affects OCaml versions prior to 4.14.3 and between 5.0.0 and 5.4.0 inclusive.
Can CVE-2026-28364 lead to data breaches?
Yes, CVE-2026-28364 can lead to data breaches through remote code execution if not addressed.