Executive brief
OCaml is a widely used programming language and runtime environment. A vulnerability in its data deserialization component allows an attacker to provide specially crafted data that can crash applications or potentially allow the execution of unauthorized commands. This is particularly critical for applications that process data from untrusted network sources or users.
Technical details
A buffer over-read exists in the OCaml runtime (runtime/intern.c) within the Marshal deserialization logic. The root cause is missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled length values from crafted Marshal data. While Marshal is known to be type-unsafe, this specific flaw allows for memory corruption that can be leveraged in a multi-phase attack chain to achieve code execution. The vulnerability affects functions such as Marshal.from_channel, Marshal.from_bytes, and Stdlib.input_value. Patches are available in OCaml versions 4.14.3 and 5.4.1.
Affected products
- OCaml OCaml < 4.14.3, 5.x < 5.4.1
Timeline
- 2025-11-04: other: Vulnerability discovered in OxCaml
- 2025-11-09: disclosed: Submitted to OCaml GitHub repository as a security advisory
- 2026-02-17: patched: Fixed OCaml releases published (4.14.3 and 5.4.1)
- 2026-02-27: advisory: CVE-2026-28364 published