# CVE-2026-28364: OCaml Marshal deserialization buffer over-read in runtime/intern.c

Source: https://junglewise.ai/threats/cve-2026-28364-ocaml-marshal-deserialization-buffer-over-read-in-runtime-intern  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-28364 · Severity: high · CVSS 7.9 · Published 2026-02-27

OCaml is a widely used programming language and runtime environment. A vulnerability in its data deserialization component allows an attacker to provide specially crafted data that can crash applications or potentially allow the execution of unauthorized commands. This is particularly critical for applications that process data from untrusted network sources or users.

Vendors: [OCaml](https://junglewise.ai/threats/vendors/ocaml).

## Quick answers

**Is CVE-2026-28364 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28364 being exploited in the wild.

**How severe is CVE-2026-28364?** High severity, with a CVSS score of 7.9, published 27 February 2026.

**Which products and versions are affected?** Ocaml < 4.14.3, 5.x < 5.4.1.

**Is there a fix for CVE-2026-28364?** A patch was published on 2026-02-17: Fixed OCaml releases published (4.14.3 and 5.4.1) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28364 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-28364?** Check whether you run Ocaml at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer over-read exists in the OCaml runtime (runtime/intern.c) within the Marshal deserialization logic. The root cause is missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled length values from crafted Marshal data. While Marshal is known to be type-unsafe, this specific flaw allows for memory corruption that can be leveraged in a multi-phase attack chain to achieve code execution. The vulnerability affects functions such as Marshal.from_channel, Marshal.from_bytes, and Stdlib.input_value. Patches are available in OCaml versions 4.14.3 and 5.4.1.

## Affected products

- OCaml OCaml < 4.14.3, 5.x < 5.4.1

## Timeline

- 2025-11-04: other: Vulnerability discovered in OxCaml
- 2025-11-09: disclosed: Submitted to OCaml GitHub repository as a security advisory
- 2026-02-17: patched: Fixed OCaml releases published (4.14.3 and 5.4.1)
- 2026-02-27: advisory: CVE-2026-28364 published

## References

- [https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json](https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json)
- [https://access.redhat.com/security/cve/CVE-2026-28364](https://access.redhat.com/security/cve/CVE-2026-28364)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2443348](https://bugzilla.redhat.com/show_bug.cgi?id=2443348)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.json)