Skip to main content

Ocaml

2 CVEs product

Monthly

CVE-2026-34353 MEDIUM PATCH This Month

OCaml's Bigarray.reshape function contains an integer overflow vulnerability that permits unauthenticated local attackers to read arbitrary memory contents when processing untrusted input. Affected versions through 4.14.3 allow an attacker with local access to trigger the overflow condition, bypassing memory protections and potentially exposing sensitive data including cryptographic keys or process memory. No public exploit code or active exploitation has been confirmed at time of analysis.

Buffer Overflow Integer Overflow Ocaml
NVD GitHub VulDB
CVSS 3.1
5.9
EPSS
0.0%
CVE-2026-28364 HIGH PATCH This Week

Remote code execution in OCaml versions before 4.14.3 and 5.x before 5.4.1 allows unauthenticated attackers to execute arbitrary code by supplying malicious serialized data that exploits insufficient bounds checking in the Marshal deserialization function. The vulnerability stems from unbounded memory copy operations in the readblock() function that processes attacker-controlled length values, enabling a multi-stage exploitation chain. No patch is currently available for affected systems.

RCE Buffer Overflow Deserialization Ocaml Red Hat +1
NVD GitHub
CVSS 3.1
7.9
EPSS
0.0%
EPSS 0% CVSS 5.9
MEDIUM PATCH This Month

OCaml's Bigarray.reshape function contains an integer overflow vulnerability that permits unauthenticated local attackers to read arbitrary memory contents when processing untrusted input. Affected versions through 4.14.3 allow an attacker with local access to trigger the overflow condition, bypassing memory protections and potentially exposing sensitive data including cryptographic keys or process memory. No public exploit code or active exploitation has been confirmed at time of analysis.

Buffer Overflow Integer Overflow Ocaml
NVD GitHub VulDB
EPSS 0% CVSS 7.9
HIGH PATCH This Week

Remote code execution in OCaml versions before 4.14.3 and 5.x before 5.4.1 allows unauthenticated attackers to execute arbitrary code by supplying malicious serialized data that exploits insufficient bounds checking in the Marshal deserialization function. The vulnerability stems from unbounded memory copy operations in the readblock() function that processes attacker-controlled length values, enabling a multi-stage exploitation chain. No patch is currently available for affected systems.

RCE Buffer Overflow Deserialization +3
NVD GitHub

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy