Ocaml vulnerabilities
Published CVEs affecting Ocaml products: 3 record(s), with severity, exploitation and fixes.
CVE-2026-41082
High · 7.8
CWE-22 Apr 16, 2026
Path Traversal in Ocaml Opam
In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.
CVE-2026-34353
Medium · 5.1
CWE-190 Mar 27, 2026
Integer Overflow or Wraparound in Ocaml
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
CVE-2026-28364
High · 7.8
CWE-126 Feb 27, 2026
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal…
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.