Back Windowsforum

OCaml Marshal Vulnerability: Patch 4.14.3 and 5.4.1 to Block RCE

Windowsforum • February 28, 2026

... remote code execution . The vulnerability is tracked as CVE‑2026‑28364 and affects OCaml releases before 4.14.3 and the 5.x line before 5.4.1. The ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OCaml Vulnerability CVE-2026-28364 Allows Remote Code Execution A vulnerability tracked as CVE-2026-28364 affects OCaml versions prior to 4.14.3 and 5.x before 5.4.1, enabling remote code execution through a multi-phase attack chain. This issue arises from a buffer over-read in the Marshal deserialization process due to missing bounds validation in the readblock() function. Patches have been released to address this vulnerability. 2 sources 64

OCaml Marshal Vulnerability: Patch 4.14.3 and 5.4.1 to Block RCE

The full story

Extracted Entities

Attack Types (1)

Vulnerabilities (1)