CVE-2026-28364: 
NixOS vulnerability analysis and mitigation

CVE-2026-28364 is a buffer over-read vulnerability in OCaml's Marshal deserialization subsystem (runtime/intern.c) that can enable remote code execution through a multi-phase attack chain. It affects OCaml versions before 4.14.3 (including all versions back to 3.07) and 5.x versions from 5.0.0 through 5.4.0. The vulnerability was discovered on November 4, 2025, first disclosed to the OCaml team on November 9, 2025, and fixed releases were published on February 17, 2026, with the CVE published on February 27, 2026. It carries a CVSS v3.1 base score of 7.8 (High) per NVD scoring, and is also tracked as OSEC-2026-01, GHSA-j26j-m5xr-g23c, and GHSA-m34r-cgq7-jhfm (OCaml Advisory, Microsoft MSRC).

The root cause is missing bounds validation (CWE-126: Buffer Over-read, CWE-502: Deserialization of Untrusted Data, CWE-754: Improper Check for Unusual or Exceptional Conditions) in the readblock() function within runtime/intern.c. This function performs unbounded memcpy() operations using attacker-controlled length values parsed directly from crafted Marshal data, without verifying that the specified length falls within allocated buffer bounds. Affected deserialization entry points include Marshal.from_channel, Marshal.from_bytes, Marshal.from_string, Stdlib.input_value, and Pervasives.input_value when processing untrusted input. Exploitation requires an attacker to supply malicious marshaled data to an application that deserializes it — the corrupted data causes undefined behavior in the OCaml runtime, enabling a multi-phase attack chain leading to code execution. The fix hardens the OCaml runtime with additional bounds checks that raise an exception on malformed input (OCaml Advisory).

Successful exploitation allows an attacker to read sensitive data from process memory (high confidentiality impact) and achieve remote code execution, resulting in high integrity and availability impacts on the affected system. Because the vulnerability is triggered through deserialization of attacker-controlled data, any OCaml application that processes untrusted Marshal input — including networked services — is at risk of full process compromise. Lateral movement is possible if the compromised process has access to internal network resources or credentials (OCaml Advisory, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.038%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection plugins are available from Nessus (IDs: 300178, 301291, 303002, 303489) and Qualys (IDs: 761164, 917506, 761717) (Microsoft MSRC).

1. Identify a target application: Locate an OCaml application (version < 4.14.3 or 5.0.0–5.4.0) that accepts and deserializes untrusted Marshal data via Marshal.from_channel, Marshal.from_bytes, Marshal.from_string, Stdlib.input_value, or Pervasives.input_value.
2. Craft malicious Marshal data: Construct a specially crafted OCaml Marshal payload that encodes an attacker-controlled length field in the serialized data stream, designed to cause readblock() to perform an out-of-bounds memcpy() operation.
3. Deliver the payload: Submit the crafted Marshal data to the target application through whatever input channel it exposes (e.g., network socket, file, IPC mechanism).
4. Trigger the buffer over-read: The vulnerable readblock() function in runtime/intern.c processes the malicious length without bounds validation, causing unbounded memory reads and corrupting the OCaml runtime state.
5. Achieve code execution: Leverage the multi-phase attack chain — exploiting the runtime corruption — to redirect execution flow and achieve arbitrary code execution in the context of the OCaml process (OCaml Advisory).

• Logs: Application crash logs or OCaml runtime exception traces referencing runtime/intern.c or readblock(); unexpected Invalid_argument or segmentation fault signals from OCaml processes handling external input.
• Process: Unusual child processes spawned by OCaml application processes (e.g., shells, network utilities); OCaml processes consuming abnormal amounts of memory or crashing repeatedly upon receiving specific inputs.
• Network: Unexpected or malformed binary data streams sent to services that accept OCaml Marshal input; repeated connection attempts delivering large or structurally anomalous payloads to Marshal-consuming endpoints.
• File System: Unexpected files written by OCaml service accounts; new executables or scripts in directories writable by the OCaml process (OCaml Advisory).

Upgrade OCaml to version 4.14.3 or later (for the 4.x branch) or 5.4.1 or later (for the 5.x branch); these releases include hardened bounds checks in the Marshal runtime that raise an exception on malformed input rather than performing unbounded memory operations. No configuration-based workaround fully mitigates the vulnerability; however, applications can reduce exposure by avoiding deserialization of untrusted Marshal data entirely, or by sandboxing OCaml processes that handle external input. Third-party libraries with custom Marshal deserializers should adopt the new Wsize_custom_data/Bsize_custom_data macros from custom.h to enforce bounds in their own deserializers. Microsoft has also released patches for affected CBL-Mariner and Azure Linux packages (OCaml Advisory, Microsoft MSRC).

The vulnerability was discovered by Justin Timperio (originally in OxCaml) and coordinated through the OCaml Security Response Team, with remediation developed by core OCaml maintainers including Xavier Leroy, Nicolás Ojeda Bär, and Gabriel Scherer. SUSE issued a security update (SUSE-2026-0800-1) for OCaml packages, and openSUSE published a corresponding security announcement. Coverage appeared on Linux security news aggregators and German-language security outlets (pro-linux.de), as well as automated CVE tracking feeds on Bluesky and Mastodon. Community discussion noted that OCaml's Marshal module has long carried a documented warning that it is unsafe for untrusted input, making this a known risk area that was insufficiently hardened (OCaml Advisory, SUSE Advisory).