CVE-2026-28364: Ocaml

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.

Affected products

• Ocaml Ocaml: before 4.14.3 (fixed in 4.14.3); from 5.0.0, before 5.4.1 (fixed in 5.4.1)

Published 2026-02-27. Last modified 2026-07-15.