CVE-2026-34353: Bigarray.reshape integer overflow
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
Other sources
The function camlbareshape, part of the OCaml runtime (in runtime/bigarray.c), had a missing check for integer overflow when computing the size to be allocated. This leads to a segmentation fault.
Any application using Bigarray.reshape (or reshapeN) with untrusted and unchecked input can result in a segmentation fault.
Timeline
- 2026-06-18 security advisory released - 2026-06-15 OCaml 4.14.4 released - 2026-04-16 Florian Angeletti backported the fix to the 4.14 branch - 2026-04-15 Stephen Dolan proposed fix https://github.com/ocaml/ocaml/pull/14691 - 2026-03-18 Andriy Sultanov reported https://github.com/ocaml/ocaml/issues/14655
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/ocamlto a version that resolves this vulnerability.Fixed in 4.14.4-r0 - Upgrade
Upgrade
opam/ocamlto a version that resolves this vulnerability.Fixed in 4.14.4 - Upgrade
Upgrade
OCamlto a version that resolves this vulnerability.Fixed in 4.14.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34353?
CVE-2026-34353 has a high severity due to the potential for arbitrary memory reading resulting from integer overflow.
How do I fix CVE-2026-34353?
To fix CVE-2026-34353, upgrade to OCaml version 4.14.4 or later, which addresses the integer overflow issue.
What type of vulnerability is CVE-2026-34353?
CVE-2026-34353 is a memory corruption vulnerability caused by an integer overflow in the Bigarray.reshape function.
Which versions of OCaml are affected by CVE-2026-34353?
CVE-2026-34353 affects OCaml versions up to and including 4.14.3.
What are the potential impacts of CVE-2026-34353?
The potential impacts of CVE-2026-34353 include unauthorized access to sensitive data and possible exploitation of application functionality.