In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The vulnerability stems from missing bounds validation in the readblock() function, which performs unbounded memcpy() operations using attacker-controlled lengths from crafted Marshal data.
Weakness
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ocaml | Ocaml | * | 4.14.3 (excluding) |
| Ocaml | Ocaml | 5.0.0 (including) | 5.4.1 (excluding) |