CVE-2026-28364

EUVD-2026-8988
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.9 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
Affected Products (NVD)
VendorProductVersion
ocamlocaml
𝑥
< 4.14.3
ocamlocaml
5.0.0 ≤
𝑥
< 5.4.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ocaml
bookworm
no-dsa
bullseye
vulnerable
forky
5.4.1-1
fixed
sid
5.4.1-1
fixed
trixie
no-dsa
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
ocaml
suse enterprise desktop 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP6
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
4.14.2-150600.3.3.1
fixed
ocaml-compiler-libs
suse enterprise desktop 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP6
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
4.14.2-150600.3.3.1
fixed
ocaml-compiler-libs-devel
suse enterprise desktop 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP6
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
4.14.2-150600.3.3.1
fixed
ocaml-ocamldoc
suse enterprise desktop 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP6
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
4.14.2-150600.3.3.1
fixed
ocaml-runtime
suse enterprise desktop 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise sap 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise sap 15 SP7
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP4
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP5
4.05.0-150200.15.3.1
fixed
suse enterprise server 15 SP6
4.14.2-150600.3.3.1
fixed
suse enterprise server 15 SP7
4.14.2-150600.3.3.1
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ocaml
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
ocaml-compiler-libs
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
ocaml-debuginfo
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
ocaml-debugsource
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
ocaml-docs
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
ocaml-ocamldoc
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
ocaml-ocamldoc-debuginfo
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
ocaml-runtime
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
ocaml-runtime-debuginfo
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
ocaml-source
Amazon Linux 2023
0:4.13.1-4.amzn2023.0.3
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
ocaml
Azure Linux 3.0
0:5.1.1-2.azl3
fixed
CBL-Mariner 2.0
0:4.13.1-3.cm2
fixed
Common Weakness Enumeration
References
https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json
https://osv.dev/vulnerability/OSEC-2026-01
https://access.redhat.com/security/cve/CVE-2026-28364
https://bugzilla.redhat.com/show_bug.cgi?id=2443348
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.json