CVE-2026-28364

HighCVSS 7.8/10Last modified Jul 15, 2026

Description

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-126 CWE-125

Affected software

Vendor	Product	Versions
OCaml	OCaml	< 4.14.3; >= 5.0.0, < 5.4.1
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Hardened Images	—

References

Timeline

Published: Feb 27, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-283679.1A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be CVE-2026-283689.1A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are par CVE-2026-283699.1A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrec CVE-2026-28374.4The Ricerca – advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to,CVE-2026-283709.1In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger cod CVE-2026-283727.8telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added CVE-2026-283739.6The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality w CVE-2026-283744.3Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.CVE-2026-283756.5A testdata data-source can be used to trigger out-of-memory crashes in Grafana.CVE-2026-283766.5The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potential CVE-2026-283777.5A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing CVE-2026-283782.7The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public d