VDB
CVE-2026-3381
CVE-2026-3381
PUBLISHED
CVSS 7.900000095367432 HIGH
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
EPSS 0.04% · 12.9th percentile
Risk Scores
CVSS 3.1
7.900000095367432
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
EPSS Score
0.04%
12.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OCaml | OCaml | 0, 5.0.0, 5.0.0 |
| ocaml | ocaml | 0, 5.0.0, 0 |
Exploit Intelligence
- https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json (circl)
- https://osv.dev/vulnerability/OSEC-2026-01 (circl)
- CIRCL seen: CVE-2026-28364 (circl-sighting)
- CIRCL seen: CVE-2026-28364 (circl-sighting)
- CIRCL seen: CVE-2026-28364 (circl-sighting)
- CIRCL seen: CVE-2026-28364 (circl-sighting)
- CIRCL seen: CVE-2026-28364 (circl-sighting)
- AZL-79380.json (github-poc)
- AZL-79380.json (github-poc)
- AZL-79380.json (github-poc)
…and 5 more exploits
Timeline
- Feb 27, 2026 PoC Published
- Feb 27, 2026 PoC Published
- Feb 27, 2026 PoC Published
- Feb 28, 2026 CVE ID Reserved
- Mar 5, 2026 EPSS Score
- Mar 5, 2026 CVE Published
- Mar 6, 2026 EPSS Score
- Mar 7, 2026 EPSS Score
- Mar 7, 2026 PoC Published
- Mar 9, 2026 EPSS Score
- Mar 10, 2026 EPSS Score
- Mar 11, 2026 EPSS Score
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-28364 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3381 advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-14027 advisory
- https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-01.json url
- https://osv.dev/vulnerability/OSEC-2026-01 url