OCaml cstruct CVE-2026-89087

Exploitation requires that: (1) the target application uses a version of cstruct before 6.3.0; (2) the application exposes a code path that passes attacker-controlled binary data directly to cstruct index operations without prior length/bounds enforcement; and (3) the application is reachable over a network or accepts untrusted input. The library is not self-executing - the vulnerability is only reachable through the calling application's use of cstruct APIs. Applications that strictly validate input lengths before handing data to cstruct, or that operate entirely on trusted/internal data, are not meaningfully exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, score 7.3) reflects the exposure profile of a network protocol parsing library: if attacker-controlled binary data reaches a vulnerable cstruct code path, no authentication or user interaction is needed. However, exploitability is inherently indirect - cstruct is a library, not a standalone service, so real-world risk depends entirely on whether a deployed OCaml application exposes vulnerable parsing to untrusted input. AC:L is plausible for applications that parse raw network frames or binary protocol fields without input gating. EPSS data is not provided; KEV status is absent, and no POC has been identified, suggesting this is not currently under active exploitation. The partial CIA impact (C:L/I:L/A:L) is consistent with index errors that allow memory reads, possible minor state corruption, or process termination in error-intolerant deployments. The 'Information Disclosure' tag in the input understates the impact - CVSS explicitly scores I:L and A:L as well.

An attacker sends a crafted binary payload - for example, a malformed network protocol frame or binary file - to an OCaml service that uses cstruct to parse it. The malformed index values trigger out-of-bounds memory access within the Bigarray buffer, leaking adjacent memory contents (e.g., session data or keys) or corrupting buffer state in a way that causes incorrect application behavior or process termination. No public exploit code has been identified at time of analysis.