CVE-2026-28364
High
Description
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
SeverityHigh
CVSS7.9
Exploit probability—
ProductOcaml
PublishedFeb 27, 2026
First seenFeb 27, 2026
Weakness typeCWE-126CWE-126
How to fix
Update
- ocaml ocaml4.14.3, 5.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ocaml ocaml | v < 4.14.3, 5.0.0 ≤ v < 5.4.1 | 4.14.3, 5.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.