Security readout for executives and security teams
Plain-English summary
OCaml’s Marshal deserialization can read beyond a buffer when handling crafted serialized data. Sources describe a multi-phase path to remote code execution. Business risk is highest where OCaml services or tools process Marshal data from untrusted users, files, or network-adjacent workflows.
Executive priority
High priority for OCaml systems that ingest serialized data from users, partners, files, queues, or network paths. For isolated internal tooling, schedule prompt upgrade during normal maintenance but still validate no untrusted Marshal input exists.
Technical view
The issue is in OCaml runtime/intern.c readblock(), where missing bounds validation allows unbounded memcpy() using attacker-controlled lengths in crafted Marshal data. Sources map this to CWE-125 and CWE-126 and list affected OCaml before 4.14.3 and 5.x before 5.4.1.
Likely exposure
Exposure depends on OCaml runtime use and whether Marshal deserialization handles untrusted input. OCaml applications using only trusted, internal Marshal data have lower practical exposure, but should still update because misuse boundaries often change.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. The CVSS vector provided is local, while the description references remote code execution through a chain; treat remote exploitability as source-claimed but context-dependent.
Researcher notes
Focus on trust-boundary analysis around Marshal inputs, not generic OCaml presence alone. Evidence identifies bounds-validation failure in readblock() and fixed version ranges, but the bundle does not provide exploit telemetry, detailed patch diff, or affected downstream package matrix.
Mitigation direction
- Upgrade OCaml 4.14 deployments to 4.14.3 or later.
- Upgrade OCaml 5.x deployments to 5.4.1 or later.
- Avoid deserializing untrusted Marshal data where feasible.
- Check Red Hat or distribution guidance for packaged OCaml status.
- Document any unavoidable Marshal trust boundaries and compensating controls.
Validation and detection
- Inventory OCaml runtime and compiler versions in production and build systems.
- Review OCaml code paths that call Marshal deserialization on external data.
- Confirm package or source builds include fixed OCaml versions.
- Check distribution advisories for backported fixes or VEX status.
- Monitor CVE, OSV, and vendor advisories for exploitation updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-126: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-28364 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N2.54.7mitreCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N2.54.7redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.9HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Base CVSS 3.1 score
7.9HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-02-27T16:01:20.960Z: Reported to Red Hat.
- 2026-02-27T03:54:53.458Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.jsonCVE reference, mitre
- https://osv.dev/vulnerability/OSEC-2026-01CVE reference, mitre
- https://access.redhat.com/security/cve/CVE-2026-28364CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2443348CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-28364.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Buffer Over-read
Buffer Over-read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.