CVE-2026-28364 Details
Description
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
A buffer over-read vulnerability has been identified in OCaml versions prior to 4.14.3 and in the 5.x series prior to 5.4.1. This vulnerability occurs in the Marshal deserialization process, specifically within the 'runtime/intern.c' file. The issue arises from inadequate bounds validation in the 'readblock()' function, which enables unbounded memory copy operations using lengths controlled by attackers, derived from manipulated Marshal data. This flaw can be exploited to execute remote code through a multi-phase attack chain.
OCaml has released fixed versions that include additional bounds checks in the runtime, raising exceptions on bad input. Third-party libraries can also harden their custom Marshal deserialization code by following the example fix for bigarrays from the standard library.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-28364 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2443348 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.json | redhat-SADP | |
| https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json | [email protected] | Vendor Advisory |
| https://osv.dev/vulnerability/OSEC-2026-01 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | redhat-SADP |
| CWE-126 | Buffer Over-read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ocaml ocaml | < 4.14.3 >= 5.0.0, < 5.4.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 6, 2026 | Initial Analysis | [email protected] |
| Feb 27, 2026 | New CVE Received | [email protected] |