OSEC-2026-25
Heap buffer overflow in the OCaml `runtime_events` consumer when parsing an oversized custom user event
ANT-2026-0JXJVEVY
Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.
This would never be encountered in a real program but can lead to a crash.
Fix
Check message lengths for all runtime event types, report a corrupt stream on mismatch.
Am I affected?
If the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.
Timeline
- 2026-08-24: vulnerability was found
- 2026-08-27: forwarded report to [email protected]
- 2027-09-05: fix merged to trunk
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
OSV Score used
Heap buffer overflow in the OCaml `runtime_events` consumer when parsing an oversized custom user event
ANT-2026-0JXJVEVY
Custom events maintains a cache of user events, it is possible to have a corrupt stream that has a valid message with one message type (which can be custom/unit/span/int) and then has the same event with a different message type.
This would never be encountered in a real program but can lead to a crash.
Fix
Check message lengths for all runtime event types, report a corrupt stream on mismatch.
Am I affected?
If the runtime events producer and consumer run in separate processes, and the producer can be tricked into producing malformed data.
Timeline
- 2026-08-24: vulnerability was found
- 2026-08-27: forwarded report to [email protected]
- 2027-09-05: fix merged to trunk
- Record
OSEC-2026-25- CVSS 4.0
- 4.5 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-06
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ocamlopam |
5 up to 5.5.2, plus listed versions 5.0.05.0.15.1.05.1.15.1.2 Show 10 moreShow less5.2.05.2.15.2.25.3.05.3.15.4.05.4.15.4.25.5.05.5.1 |
5.5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
OSEC-2026-25 is a medium vulnerability (CVSS 4.5) in ocaml, published October 23, 2026. No source lists public exploit code. Fixed in ocaml 5.5.2.