OSEC-2026-22
Integer overflow in Unix.map_file
ANT-2026-6W9NPC2Q mmap dimension product integer overflow
Fix
Use caml_umul_overflow instead of * when multiplying bigarray dimensions, which detects integer overflows and raise Failure.
Negative positions are also rejected by raising Invalid_argument.
Am I affected?
If either the dimensions or the file size in a call to Unix.map_file from your code is user controllable then you are potentially affected.
Score notes
The vulnerability is in a library, and the CVSS score is calculated under worst case assumptions. For an actual application the score will depend on how much an attacker can control the input to this function (if at all).
Timeline
- 2026-08-24: vulnerability was found
- 2026-08-27: forwarded report to [email protected]
- 2026-09-29: fix merged to trunk
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
What each source reports
OSV Score used
Integer overflow in Unix.map_file
ANT-2026-6W9NPC2Q mmap dimension product integer overflow
Fix
Use caml_umul_overflow instead of * when multiplying bigarray dimensions, which detects integer overflows and raise Failure.
Negative positions are also rejected by raising Invalid_argument.
Am I affected?
If either the dimensions or the file size in a call to Unix.map_file from your code is user controllable then you are potentially affected.
Score notes
The vulnerability is in a library, and the CVSS score is calculated under worst case assumptions. For an actual application the score will depend on how much an attacker can control the input to this function (if at all).
Timeline
- 2026-08-24: vulnerability was found
- 2026-08-27: forwarded report to [email protected]
- 2026-09-29: fix merged to trunk
- Record
OSEC-2026-22- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ocamlopam |
before 4.14.5, 5 up to 5.5.2, plus listed versions 3.073.07+13.07+23.08.03.08.1 Show 45 moreShow less3.08.23.08.33.08.43.09.03.09.13.09.23.09.33.10.03.10.13.10.23.11.03.11.13.11.23.12.03.12.14.00.04.00.14.01.04.02.04.02.14.02.24.02.34.02.44.03.04.03.14.04.04.04.14.04.24.04.34.05.04.05.14.06.04.06.14.06.24.07.04.07.14.07.24.08.04.08.14.08.24.09.04.09.14.09.24.10.04.10.1 |
4.14.55.5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, facts | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
OSEC-2026-22 is a medium vulnerability (CVSS 5.5) in ocaml, published October 23, 2026. No source lists public exploit code. Fixed in ocaml 4.14.5.
Left out here: 32 versions. The JSON record has them.