CVE-2026-28364

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.

CVSS v3 7.9 HIGH

7.9^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.5 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json	Vendor Advisory
https://osv.dev/vulnerability/OSEC-2026-01	Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-28364
https://bugzilla.redhat.com/show_bug.cgi?id=2443348
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.json

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ocaml:ocaml::::::::
	cpe:2.3:a:ocaml:ocaml::::::::

History

No history.

Information

Published : 2026-02-27 04:16

Updated : 2026-07-15 02:19

NVD link : CVE-2026-28364

Mitre link : CVE-2026-28364

CVE.ORG link : CVE-2026-28364

JSON object : View

Products Affected

ocaml

ocaml

CWE

CWE-126

Buffer Over-read

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-28364", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28364", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T15:48:53.652379Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.5}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "OCaml", "product": "OCaml", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.3", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.4.1", "versionType": "semver"}], "packageURL": "pkg:opam/ocaml", "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "ocaml", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "ocaml", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "ocaml", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "ocaml", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "ocaml", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:hummingbird:1"], "vendor": "Red Hat", "product": "Red Hat Hardened Images", "packageName": "ocaml", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-02-27T04:16:03.410", "references": [{"url": "https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://osv.dev/vulnerability/OSEC-2026-01", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-28364", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443348", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-126"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data."}, {"lang": "es", "value": "En OCaml anterior a 4.14.3 y 5.x anterior a 5.4.1, un desbordamiento de lectura de b\u00fafer en la deserializaci\u00f3n de Marshal (runtime/intern.c) permite la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de una cadena de ataque multifase. La vulnerabilidad radica en la falta de validaci\u00f3n de l\u00edmites en la funci\u00f3n readblock(), que realiza operaciones memcpy() sin l\u00edmites utilizando longitudes controladas por el atacante a partir de datos Marshal manipulados."}], "lastModified": "2026-07-15T02:19:14.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C54A8C4D-61D8-446B-8DCA-FBF8394EE7B6", "versionEndExcluding": "4.14.3"}, {"criteria": "cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "296325F6-F724-4C88-9A80-6D5696A35225", "versionEndExcluding": "5.4.1", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}