Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-27 | 2 | Disclosure2 |
| 2026-03-04 | 1 | Disclosure1 |
| 2026-03-08 | 1 | Disclosure1 |
CVE-2026-28364 In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase atta… https://www.cve.org/CVERecord?id=CVE-2026-28364
Post summary
A buffer over‑read in OCaml’s Marshal deserialization (runtime/intern.c) enables remote code execution in versions before 4.14.3 and 5.x before 5.4.1, as documented in the CVE record.
CVE-2026-28364,OSEC-2026-01: OCaml runtime: Buffer Over-Read in OCaml Marshal Deserialization https://www.openwall.com/lists/oss-security/2026/02/27/4 Unbounded memcpy() operations using attacker-controlled lengths from malicious Marshal data. Marshal should not used in contexts where attacker can control data.
Post summary
The notice discloses a buffer over-read in OCaml’s Marshal deserialization caused by unbounded memcpy, but provides no PoC, exploit code, patch, or evidence of active exploitation.
CVE-2026-28364 (CVSS:7.9, HIGH) is Undergoing Analysis. In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables re..https://nvd.nist.gov/vuln/detail/CVE-2026-28364 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-28364, a high‑severity buffer over‑read in OCaml’s Marshal deserialization, providing technical details but no PoC, exploit, or patch information.
CVE-2026-28364 OCaml Marshal Deserialization Remote Code Execution Vulnerability Before 4.14.3 and 5.4.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28364
Post summary
An OCaml Marshal deserialization remote code execution vulnerability affecting versions before 4.14.3 and 5.4.1 has been disclosed with basic technical details; no PoC, exploit code, patch, or active exploitation reported.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ocaml | ocaml | - | - | - |