Description
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OCaml | OCaml | < 4.14.3, 5.0.0 – < 5.4.1 | 4.14.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ocaml | 5.4.1-1 | — |
| Debian 13 | ocaml | No fix yet | — |
| Debian 12 | ocaml | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ocaml | No fix yet | — |
| Ubuntu 26.04 LTS | ocaml | No fix yet | — |
| Ubuntu 25.10 | ocaml | No fix yet | — |
| Ubuntu 24.04 LTS | ocaml | No fix yet | — |
| Ubuntu 22.04 LTS | ocaml | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ocaml | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ocaml | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ocaml | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ocaml | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | ocaml | 4.14.2-150600.3.3.1 | SUSE-SU-2026:0830-1 |
| SLES 15 SP6 | ocaml | 4.14.2-150600.3.3.1 | SUSE-SU-2026:0830-1 |
| SLES 15 SP5 | ocaml | 4.05.0-150200.15.3.1 | SUSE-SU-2026:0800-1 |
| SLES 15 SP4 | ocaml | 4.05.0-150200.15.3.1 | SUSE-SU-2026:0800-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | ocaml | 4.14.2-150600.3.3.1 | SUSE-SU-2026:0830-1 |
| SLES for SAP 15 SP5 | ocaml | 4.05.0-150200.15.3.1 | SUSE-SU-2026:0800-1 |
| SLES for SAP 15 SP4 | ocaml | 4.05.0-150200.15.3.1 | SUSE-SU-2026:0800-1 |
| SLE HPC 15 SP5 | ocaml | 4.05.0-150200.15.3.1 | SUSE-SU-2026:0800-1 |
| SLE HPC 15 SP4 | ocaml | 4.05.0-150200.15.3.1 | SUSE-SU-2026:0800-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ocaml | 4.14.4-1.1 | openSUSE-SU-2026:11136-1 |
| openSUSE Leap 16.0 | ocaml | 4.14.2-160000.4.1 | openSUSE-SU-2026:20368-1 |
| openSUSE Leap 15.6 | ocaml | 4.14.2-150600.3.3.1 | SUSE-SU-2026:0830-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ocaml +5 | 4.13.1-4.amzn2023.0.3 | ALAS2023-2026-1479 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ocaml | 5.1.1-2 | — |
| Azure Linux 2 (CBL-Mariner) | ocaml | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Akshay-M-Singh/ocaml-marshal-vulnerability ★ 0 · Sep 24, 2026
I found an integer overflow that defeats OCaml's fix for CVE-2026-28364: heap memory disclosure and SIGBUS crashes via Marshal deserialization. PoCs, advisory, and proposed patch — fixed in OCaml 5.5…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- openSUSE-SU-2026:11136-1 ocaml-4.14.4-1.1 on GA media SUSE / openSUSE Security Updates · Jun 29, 2026
- ALAS2023-2026-1479 Important: ocaml security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 27, 2026
- openSUSE-SU-2026:20368-1 Security update for ocaml SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2026:0830-1 Security update for ocaml SUSE / openSUSE Security Updates · Mar 6, 2026
- SUSE-SU-2026:0800-1 Security update for ocaml SUSE / openSUSE Security Updates · Mar 5, 2026