PT-2026-28619 · Ocaml · Ocaml

Published 2026-03-27 · Updated 2026-04-11 · CVE-2026-34353

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OCaml versions through 4.14.3

Description The Bigarray.reshape function in OCaml versions through 4.14.3 contains an integer overflow issue. This can lead to arbitrary memory being read when processing untrusted data. The function Bigarray.reshape is susceptible to this issue.

Recommendations Update to a version of OCaml newer than 4.14.3. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-34353

OESA-2026-1889

OESA-2026-1890

OESA-2026-1891

OESA-2026-1892

OESA-2026-1893

Affected Products

Ocaml

References · 19

• https://osv.dev/vulnerability/OESA-2026-1889 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34353 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34353 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34353 · Security Note
• https://ubuntu.com/security/CVE-2026-34353 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34353 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1893 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34353 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1891 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1890 · Vendor Advisory
• https://github.com/ocaml/ocaml/pull/14674 · Note
• https://github.com/ocaml/ocaml/issues/14655 · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1890 · Note
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1893 · Note