{"id":"OSEC-2026-22","aliases":[],"status":"published","title":"Integer overflow in Unix.map_file","description":"ANT-2026-6W9NPC2Q mmap dimension product integer overflow\n\n\n## Fix\n\nUse `caml_umul_overflow` instead of `*` when multiplying bigarray dimensions, which detects integer overflows and raise `Failure`.\nNegative positions are also rejected by raising `Invalid_argument`.\n\n## Am I affected?\n\nIf either the dimensions or the file size in a call to `Unix.map_file` from your code is user controllable then you are potentially affected.\n\n## Score notes\n\nThe vulnerability is in a library, and the CVSS score is calculated [under worst case assumptions](https://www.first.org/cvss/v4.0/user-guide#Assessing-Vulnerabilities-in-Software-Libraries-and-Similar). For an actual application the score will depend on how much an attacker can control the input to this function (if at all).\n\n\n## Timeline\n\n- 2026-08-24: vulnerability was found\n- 2026-08-27: forwarded report to security@ocaml.org\n- 2026-09-29: fix merged to trunk","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-23T21:30:00Z","modified":"2026-11-06T13:45:04Z","fixes":[{"ecosystem":"opam","package":"ocaml","fixed_in":["4.14.5","5.5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"opam","package":"ocaml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.5"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5"},{"fixed":"5.5.2"}]}],"versions":["3.07","3.07+1","3.07+2","3.08.0","3.08.1","3.08.2","3.08.3","3.08.4","3.09.0","3.09.1","3.09.2","3.09.3","3.10.0","3.10.1","3.10.2","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","4.00.0","4.00.1","4.01.0","4.02.0","4.02.1","4.02.2","4.02.3","4.02.4","4.03.0","4.03.1","4.04.0","4.04.1","4.04.2","4.04.3","4.05.0","4.05.1","4.06.0","4.06.1","4.06.2","4.07.0","4.07.1","4.07.2","4.08.0","4.08.1","4.08.2","4.09.0","4.09.1","4.09.2","4.10.0","4.10.1","4.10.2","4.10.3","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.12.1","4.12.2","4.13.0","4.13.1","4.13.2","4.14.0","4.14.1","4.14.2","4.14.3","4.14.4","5.0.0","5.0.1","5.1.0","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1"]}],"sources":{"osv":[{"id":"OSEC-2026-22","title":"Integer overflow in Unix.map_file","description":"ANT-2026-6W9NPC2Q mmap dimension product integer overflow\n\n\n## Fix\n\nUse `caml_umul_overflow` instead of `*` when multiplying bigarray dimensions, which detects integer overflows and raise `Failure`.\nNegative positions are also rejected by raising `Invalid_argument`.\n\n## Am I affected?\n\nIf either the dimensions or the file size in a call to `Unix.map_file` from your code is user controllable then you are potentially affected.\n\n## Score notes\n\nThe vulnerability is in a library, and the CVSS score is calculated [under worst case assumptions](https://www.first.org/cvss/v4.0/user-guide#Assessing-Vulnerabilities-in-Software-Libraries-and-Similar). For an actual application the score will depend on how much an attacker can control the input to this function (if at all).\n\n\n## Timeline\n\n- 2026-08-24: vulnerability was found\n- 2026-08-27: forwarded report to security@ocaml.org\n- 2026-09-29: fix merged to trunk","status":"published","published":"2026-10-23T21:30:00Z","modified":"2026-11-06T19:14:07.304434453Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-06T19:35:47.810794Z"}]}}