{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-28364", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-02-27T03:54:53.320Z", "datePublished": "2026-02-27T03:54:53.458Z", "dateUpdated": "2026-02-27T15:49:06.382Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageURL": "pkg:opam/ocaml", "product": "OCaml", "vendor": "OCaml", "versions": [{"lessThan": "4.14.3", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "5.4.1", "status": "affected", "version": "5.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-126", "description": "CWE-126 Buffer Over-read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-02-27T03:58:04.453Z"}, "references": [{"url": "https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json"}, {"url": "https://osv.dev/vulnerability/OSEC-2026-01"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.14.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0.0", "versionEndExcluding": "5.4.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T15:48:53.652379Z", "id": "CVE-2026-28364", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T15:49:06.382Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28364", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T15:48:53.652379Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T15:49:01.471Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "OCaml", "product": "OCaml", "versions": [{"status": "affected", "version": "0", "lessThan": "4.14.3", "versionType": "semver"}, {"status": "affected", "version": "5.0.0", "lessThan": "5.4.1", "versionType": "semver"}], "packageURL": "pkg:opam/ocaml", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json"}, {"url": "https://osv.dev/vulnerability/OSEC-2026-01"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-126", "description": "CWE-126 Buffer Over-read"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.3"}, {"criteria": "cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.1", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-02-27T03:58:04.453Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28364", "state": "PUBLISHED", "dateUpdated": "2026-02-27T15:49:06.382Z", "dateReserved": "2026-02-27T03:54:53.320Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-02-27T03:54:53.458Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data."}, {"lang": "es", "value": "En OCaml anterior a 4.14.3 y 5.x anterior a 5.4.1, un desbordamiento de lectura de b\u00fafer en la deserializaci\u00f3n de Marshal (runtime/intern.c) permite la ejecuci\u00f3n remota de c\u00f3digo a trav\u00e9s de una cadena de ataque multifase. La vulnerabilidad radica en la falta de validaci\u00f3n de l\u00edmites en la funci\u00f3n readblock(), que realiza operaciones memcpy() sin l\u00edmites utilizando longitudes controladas por el atacante a partir de datos Marshal manipulados."}], "id": "CVE-2026-28364", "lastModified": "2026-02-27T14:06:37.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.7, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2026-02-27T04:16:03.410", "references": [{"source": "cve@mitre.org", "url": "https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json"}, {"source": "cve@mitre.org", "url": "https://osv.dev/vulnerability/OSEC-2026-01"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-126"}], "source": "cve@mitre.org", "type": "Primary"}]}

{"bugzilla": {"description": "ocaml: OCaml: Remote code execution via buffer over-read in Marshal deserialization", "id": "2443348", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443348"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.9", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.", "A flaw was found in OCaml. A remote attacker could exploit a buffer over-read vulnerability during Marshal deserialization by providing specially crafted data. This issue stems from missing bounds validation in the readblock() function, which performs unbounded memory copy operations. Successful exploitation could lead to remote code execution."], "name": "CVE-2026-28364", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "ocaml", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "ocaml", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "ocaml", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "ocaml", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "ocaml", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-27T03:54:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-28364\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-28364\nhttps://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json\nhttps://osv.dev/vulnerability/OSEC-2026-01"], "threat_severity": "Important"}