{"id":"CVE-2026-34353","aliases":["ALPINE-CVE-2026-34353","AZL-81104","DEBIAN-CVE-2026-34353","EUVD-2026-16555","GHSA-6p45-jv22-32gp","OESA-2026-1889","OESA-2026-1890","OESA-2026-1891","OESA-2026-1892","OESA-2026-1893","OSEC-2026-04","UBUNTU-CVE-2026-34353","openSUSE-SU-2026:11136-1"],"status":"published","title":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of...","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00116,"percentile":0.0163,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-03-27T04:55:58Z","modified":"2026-11-06T13:45:04Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"ocaml","fixed_in":["4.14.4-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"ocaml","fixed_in":["5.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ocaml","fixed_in":["5.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ocaml","fixed_in":["5.2.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"ocaml","fixed_in":["4.14.1-7.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"ocaml","fixed_in":["4.13.1-9.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"ocaml","fixed_in":["4.14.1-7.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"ocaml","fixed_in":["4.14.1-7.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"ocaml","fixed_in":["4.14.1-7.oe2403sp2"],"sources":["osv"]},{"ecosystem":"opam","package":"ocaml","fixed_in":["4.14.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.1-4","4.13.1-5","4.13.1-5~exp1","4.13.1-6","4.14.1-1","4.14.1-1+loong64.2","4.14.1-1~exp1","5.2.0-1","5.2.0-1~exp1","5.2.0-1~exp2","5.2.0-1~exp3","5.2.0-1~exp4","5.2.0-2","5.2.0-3","5.2.0-3+hurd.1","5.2.0-3+hurd.2","5.3.0-1","5.3.0-1+hurd.1","5.3.0-1~exp1","5.3.0-1~exp2","5.3.0-2","5.3.0-3","5.4.0-1","5.4.0-1~exp1","5.4.0-1~exp2","5.4.0-1~exp3","5.4.0-2","5.4.0-3","5.4.1-1","5.4.1-1~exp1","5.5.0-1~exp1","5.5.0-1~exp2","5.5.1-1~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.1-7.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.1-9.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.1-7.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.1-7.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.1-7.oe2403sp2"}]}]},{"source":"osv","ecosystem":"opam","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4"}]}],"versions":["3.07","3.07+1","3.07+2","3.08.0","3.08.1","3.08.2","3.08.3","3.08.4","3.09.0","3.09.1","3.09.2","3.09.3","3.10.0","3.10.1","3.10.2","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","4.00.0","4.00.1","4.01.0","4.02.0","4.02.1","4.02.2","4.02.3","4.02.4","4.03.0","4.03.1","4.04.0","4.04.1","4.04.2","4.04.3","4.05.0","4.05.1","4.06.0","4.06.1","4.06.2","4.07.0","4.07.1","4.07.2","4.08.0","4.08.1","4.08.2","4.09.0","4.09.1","4.09.2","4.10.0","4.10.1","4.10.2","4.10.3","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.12.1","4.12.2","4.13.0","4.13.1","4.13.2","4.14.0","4.14.1","4.14.2","4.14.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.1-4ubuntu1","4.01.0-3ubuntu2","4.01.0-3ubuntu3","4.01.0-3ubuntu3.1","4.01.0-3ubuntu3.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.01.0-4ubuntu1","4.02.3-5ubuntu1","4.02.3-5ubuntu2","4.02.3-5ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.04.0-2ubuntu4","4.05.0-10ubuntu1","4.05.0-10ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.05.0-12ubuntu3","4.08.1-8"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.11.1-4","4.11.1-5ubuntu1","4.13.1-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.1-6ubuntu1","4.14.1-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.4-1.1"}]}],"bundled":2}],"products":[{"vendor":"ocaml","product":"ocaml"}],"references":[{"url":"https://github.com/ocaml/ocaml/issues/14655","tags":["Issue Tracking","report"]},{"url":"https://github.com/ocaml/ocaml/pull/14674","tags":["Issue Tracking","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34353","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-6p45-jv22-32gp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-34353","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34353.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34353","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1889","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1890","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1891","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1892","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1893","tags":["advisory"]},{"url":"https://github.com/ocaml/ocaml/pull/14691","tags":["fix"]},{"url":"https://ubuntu.com/security/CVE-2026-34353","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34353","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34353","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-34353","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","status":"published","published":"2026-03-27T04:55:58.294Z","modified":"2026-03-27T13:45:47.35Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-16555","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","status":"published","published":"2026-03-27T04:55:58Z","modified":"2026-03-27T13:45:47Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:27.67679Z"}],"ghsa":[{"id":"GHSA-6p45-jv22-32gp","title":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of...","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","status":"published","published":"2026-03-27T06:31:43Z","modified":"2026-03-27T06:31:54Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:06:54.074781Z"}],"nvd":[{"id":"CVE-2026-34353","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","status":"published","published":"2026-03-27T06:16:39.333Z","modified":"2026-06-17T10:38:55.95Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"ALPINE-CVE-2026-34353","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","status":"published","published":"2026-03-27T06:16:39.333Z","modified":"2026-11-03T06:32:54.878677846Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-34353","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","status":"published","published":"2026-03-27T04:55:58.294Z","modified":"2026-10-28T02:30:35.119780538Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34353","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","status":"published","published":"2026-03-27T06:16:39.333Z","modified":"2026-10-01T03:03:03.816746665Z","cvss":[{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"OESA-2026-1889","title":"ocaml security update","description":"OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.\r\n\r\nSecurity Fix(es):\n\nIn OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)","status":"published","published":"2026-04-11T11:10:54Z","modified":"2026-08-18T01:19:47.182490235Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1890","title":"ocaml security update","description":"OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.\r\n\r\nSecurity Fix(es):\n\nIn OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)","status":"published","published":"2026-04-11T11:10:54Z","modified":"2026-08-18T01:19:47.23467249Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1891","title":"ocaml security update","description":"OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.\r\n\r\nSecurity Fix(es):\n\nIn OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)","status":"published","published":"2026-04-11T11:10:54Z","modified":"2026-08-18T01:19:47.539735648Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1892","title":"ocaml security update","description":"OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.\r\n\r\nSecurity Fix(es):\n\nIn OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)","status":"published","published":"2026-04-11T11:10:54Z","modified":"2026-08-18T01:19:47.728663773Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OESA-2026-1893","title":"ocaml security update","description":"OCaml is a high-level, strongly-typed, functional and object-oriented programming language from the ML family of languages. This package includes runtime environment, X11 support ,Documentation generator and emacs.\r\n\r\nSecurity Fix(es):\n\nIn OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.(CVE-2026-34353)","status":"published","published":"2026-04-11T11:10:54Z","modified":"2026-08-18T01:19:47.508440682Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"OSEC-2026-04","title":"Bigarray.reshape integer overflow","description":"The function `caml_ba_reshape`, part of the OCaml runtime (in runtime/bigarray.c), had a missing check for integer overflow when computing the size to be allocated. This leads to a segmentation fault.\n\nAny application using `Bigarray.reshape` (or `reshape_N`) with untrusted and unchecked input can result in a segmentation fault.\n\n## Timeline\n\n- 2026-06-18 security advisory released\n- 2026-06-15 OCaml 4.14.4 released\n- 2026-04-16 Florian Angeletti backported the fix to the 4.14 branch\n- 2026-04-15 Stephen Dolan proposed fix https://github.com/ocaml/ocaml/pull/14691\n- 2026-03-18 Andriy Sultanov reported https://github.com/ocaml/ocaml/issues/14655","status":"published","published":"2026-06-18T13:20:00Z","modified":"2026-11-06T19:14:07.698910244Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-06T19:35:47.566811Z"},{"id":"UBUNTU-CVE-2026-34353","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","status":"published","published":"2026-03-27T06:16:00Z","modified":"2026-04-27T18:57:03.909584Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.1,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-81104","title":"CVE-2026-34353 affecting package ocaml for versions less than 5.1.1-1","description":"In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.","status":"published","published":"2026-03-27T06:16:39Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"openSUSE-SU-2026:11136-1","title":"ocaml-4.14.4-1.1 on GA media","description":"These are all security issues fixed in the ocaml-4.14.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-27T00:00:00Z","modified":"2026-06-29T09:45:08.570151824Z","updated_at":"2026-11-02T16:58:38.95195Z"}]}}