CVE-2026-28364 Memory corruption in OCaml
A buffer over-read in OCaml's Marshal deserialization allows remote code execution via crafted data, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-28364?
CVE-2026-28364 is a high-severity memory corruption vulnerability in OCaml, published on 27 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Which versions are affected by CVE-2026-28364?
It affects 1 product.
Linux distribution packages (13)
ocaml SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 4.05.0-150200.15.3.1 |
ocaml SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 4.05.0-150200.15.3.1 |
ocaml SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | All versions | 4.05.0-150200.15.3.1 |
ocaml SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | All versions | 4.05.0-150200.15.3.1 |
ocaml SUSE:Linux Enterprise Module for Development Tools 15 SP7 | All versions | 4.14.2-150600.3.3.1 |
ocaml SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 4.05.0-150200.15.3.1 |
ocaml SUSE:Linux Enterprise Server 15 SP5-LTSS | All versions | 4.05.0-150200.15.3.1 |
ocaml SUSE:Linux Enterprise Server 15 SP6-LTSS | All versions | 4.14.2-150600.3.3.1 |
ocaml SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 4.05.0-150200.15.3.1 |
ocaml SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | All versions | 4.05.0-150200.15.3.1 |
ocaml SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | All versions | 4.14.2-150600.3.3.1 |
ocaml openSUSE:Leap 15.6 | All versions | 4.14.2-150600.3.3.1 |
ocaml openSUSE:Leap 16.0 | All versions | 4.14.2-160000.4.1 |
Products include Ocaml Ocaml.
How do I fix CVE-2026-28364?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-28364 being exploited?
There is no known exploitation of CVE-2026-28364 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in OCaml
Sources
Also known as AZL-78495, AZL-79502, DEBIAN-CVE-2026-28364, GHSA-g54x-7hpm-29q8, GHSA-j26j-m5xr-g23c, GHSA-m34r-cgq7-jhfm and 12 more.