CVE-2026-34353
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of...
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Record
CVE-2026-34353- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
EUVDEUVD-2026-16555
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Record
EUVD-2026-16555- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6p45-jv22-32gp
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of...
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Record
GHSA-6p45-jv22-32gp- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
NVD
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Record
CVE-2026-34353- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVALPINE-CVE-2026-34353
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Record
ALPINE-CVE-2026-34353- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSV
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Record
CVE-2026-34353- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-190
- Updated
- 2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2026-34353
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Record
DEBIAN-CVE-2026-34353- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2026-1889
ocaml security update
OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.
Security Fix(es):
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)
- Record
OESA-2026-1889- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2026-1890
ocaml security update
OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.
Security Fix(es):
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)
- Record
OESA-2026-1890- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2026-1891
ocaml security update
OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.
Security Fix(es):
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)
- Record
OESA-2026-1891- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2026-1892
ocaml security update
OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.
Security Fix(es):
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)
- Record
OESA-2026-1892- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2026-1893
ocaml security update
OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.
Security Fix(es):
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)
- Record
OESA-2026-1893- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVOSEC-2026-04
Bigarray.reshape integer overflow
The function caml_ba_reshape, part of the OCaml runtime (in runtime/bigarray.c), had a missing check for integer overflow when computing the size to be allocated. This leads to a segmentation fault.
Any application using Bigarray.reshape (or reshape_N) with untrusted and unchecked input can result in a segmentation fault.
Timeline
- 2026-06-18 security advisory released
- 2026-06-15 OCaml 4.14.4 released
- 2026-04-16 Florian Angeletti backported the fix to the 4.14 branch
- 2026-04-15 Stephen Dolan proposed fix https://github.com/ocaml/ocaml/pull/14691
- 2026-03-18 Andriy Sultanov reported https://github.com/ocaml/ocaml/issues/14655
- Record
OSEC-2026-04- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-06
OSVUBUNTU-CVE-2026-34353
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Record
UBUNTU-CVE-2026-34353- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N - CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-81104 No score
CVE-2026-34353 affecting package ocaml for versions less than 5.1.1-1
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
- Record
AZL-81104- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:11136-1 No score
ocaml-4.14.4-1.1 on GA media
These are all security issues fixed in the ocaml-4.14.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11136-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ocamlAlpine:v3.24 |
before 4.14.4-r0 | 4.14.4-r0 |
ocamlAzure Linux:3 |
before 5.1.1-1 | 5.1.1-1 |
ocamlDebian:12 |
All versions, plus listed versions 4.13.1-44.13.1-54.13.1-5~exp14.13.1-64.14.1-1 Show 28 moreShow less4.14.1-1+loong64.24.14.1-1~exp15.2.0-15.2.0-1~exp15.2.0-1~exp25.2.0-1~exp35.2.0-1~exp45.2.0-25.2.0-35.2.0-3+hurd.15.2.0-3+hurd.25.3.0-15.3.0-1+hurd.15.3.0-1~exp15.3.0-1~exp25.3.0-25.3.0-35.4.0-15.4.0-1~exp15.4.0-1~exp25.4.0-1~exp35.4.0-25.4.0-35.4.1-15.4.1-1~exp15.5.0-1~exp15.5.0-1~exp25.5.1-1~exp1 |
None known |
ocamlDebian:13 |
before 5.2.0-1 | 5.2.0-1 |
ocamlDebian:14 |
before 5.2.0-1 | 5.2.0-1 |
ocamlopenEuler:24.03-LTS-SP3 |
before 4.14.1-7.oe2403sp3 | 4.14.1-7.oe2403sp3 |
ocamlopenEuler:22.03-LTS-SP4 |
before 4.13.1-9.oe2203sp4 | 4.13.1-9.oe2203sp4 |
ocamlopenEuler:24.03-LTS |
before 4.14.1-7.oe2403 | 4.14.1-7.oe2403 |
ocamlopenEuler:24.03-LTS-SP1 |
before 4.14.1-7.oe2403sp1 | 4.14.1-7.oe2403sp1 |
ocamlopenEuler:24.03-LTS-SP2 |
before 4.14.1-7.oe2403sp2 | 4.14.1-7.oe2403sp2 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ocamlopam |
before 4.14.4, plus listed versions 3.073.07+13.07+23.08.03.08.1 Show 45 moreShow less3.08.23.08.33.08.43.09.03.09.13.09.23.09.33.10.03.10.13.10.23.11.03.11.13.11.23.12.03.12.14.00.04.00.14.01.04.02.04.02.14.02.24.02.34.02.44.03.04.03.14.04.04.04.14.04.24.04.34.05.04.05.14.06.04.06.14.06.24.07.04.07.14.07.24.08.04.08.14.08.24.09.04.09.14.09.24.10.04.10.1 |
4.14.4 |
ocamlUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.12.1-4ubuntu14.01.0-3ubuntu24.01.0-3ubuntu34.01.0-3ubuntu3.14.01.0-3ubuntu3.1+esm1 |
None known |
ocamlUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.01.0-4ubuntu14.02.3-5ubuntu14.02.3-5ubuntu24.02.3-5ubuntu2+esm1 |
None known |
ocamlUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.04.0-2ubuntu44.05.0-10ubuntu14.05.0-10ubuntu1+esm1 |
None known |
ocamlUbuntu:20.04:LTS |
All versions, plus listed versions 4.05.0-12ubuntu34.08.1-8 |
None known |
ocamlUbuntu:22.04:LTS |
All versions, plus listed versions 4.11.1-44.11.1-5ubuntu14.13.1-3ubuntu1 |
None known |
ocamlUbuntu:24.04:LTS |
All versions, plus listed versions 4.13.1-6ubuntu14.14.1-1ubuntu1 |
None known |
ocamlopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 4.14.4-1.1 | 4.14.4-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | ||
| facts | OSV | |
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34353 is a medium vulnerability (CVSS 5.9) in Ocaml, published March 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. Fixed in ocaml 4.14.4-r0.
References
github.com/ocaml/ocaml/issues/14655
nvd.nist.gov/vuln/detail/CVE-2026-34353
security.alpinelinux.org/vuln/CVE-2026-34353
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2026-34353
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-1889
ubuntu.com/security/CVE-2026-34353
cve.org/CVERecord?id=CVE-2026-34353
suse.com/security/cve/CVE-2026-28364
Left out here: 16 versions. The JSON record has them.