Description (CNA)
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OCaml / OCaml | affected 0 before 4.14.3; affected 5.0.0 before 5.4.1 |
CWE
CWE-126
References
- https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json
- https://osv.dev/vulnerability/OSEC-2026-01
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in OCaml. A remote attacker could exploit a buffer over-read vulnerability during Marshal deserialization by providing specially crafted data. This issue stems from missing bounds validation in the readblock() function, which performs unbounded memory copy operations. Successful exploitation could lead to remote code execution.