CVE-2026-28364
High · 7.9CVSS
7.9
EPSS
0.3%
Published
Feb 27, 2026
CISA due date
—
The record
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | ocaml | 0 | 4.05.0-150200.15.3.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | ocaml | 0 | 4.05.0-150200.15.3.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | ocaml | 0 | 4.05.0-150200.15.3.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | ocaml | 0 | 4.05.0-150200.15.3.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | ocaml | 0 | 4.14.2-150600.3.3.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | ocaml | 0 | 4.05.0-150200.15.3.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | ocaml | 0 | 4.05.0-150200.15.3.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | ocaml | 0 | 4.14.2-150600.3.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | ocaml | 0 | 4.05.0-150200.15.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | ocaml | 0 | 4.05.0-150200.15.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | ocaml | 0 | 4.14.2-150600.3.3.1 |
| opam | ocaml | 0 | 4.14.3 |
| openSUSE:Leap 15.6 | ocaml | 0 | 4.14.2-150600.3.3.1 |
| openSUSE:Leap 16.0 | ocaml | 0 | 4.14.2-160000.4.1 |
| openSUSE:Tumbleweed | ocaml | 0 | 4.14.4-1.1 |
Related vulnerabilities
- OSEC-2026-01 Buffer Over-Read in OCaml Marshal Deserialization Same vulnerability
- OSEC-2026-05 Windows command execution via filename quotes. Also affects ocaml
- OSEC-2026-04 Bigarray.reshape integer overflow Also affects ocaml
- CVE-2026-34353 In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant… Also affects ocaml
- CVE-2026-112404 Pillow is a Python imaging library. CWE-126
- CVE-2026-112394 Pillow is a Python imaging library. CWE-126
- CVE-2026-85745 MariaDB server is a community developed fork of MySQL server. CWE-126
- CVE-2026-97399 The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8… CWE-126