CVE-2026-28364 is an integer overflow in OCaml's Marshal deserializer's length-validation logic. The vulnerability arises because the sum of offset, header length, and data length is computed using unsigned 64-bit addition that can wrap around, allowing an attacker-controlled data length field to bypass bounds checks. This causes the internal pointer 'intern_src_end' to wrap to a location before the input buffer, invalidating all subsequent read boundary checks. As a result, the deserializer can read heap memory beyond the input buffer, leading to out-of-bounds reads. The vulnerability affects the OCaml functions Marshal.from_bytes, Marshal.from_string, and the C API caml_input_value_from_block. Exploits include heap information disclosure and denial of service via crashes. The issue was reported on 2026-08-15, patched by 2026-09-05 in OCaml 5.5.1, and affects many versions prior to 5.5.1.

Successful exploitation allows an attacker to cause out-of-bounds heap reads during deserialization, potentially leaking sensitive heap memory contents (information disclosure). It can also cause denial of service through crashes (SIGBUS/SIGSEGV). There is no indication of code execution or privilege escalation. The vulnerability impacts confidentiality and availability but not integrity.

A patch is available and was released in OCaml version 5.5.1. Users should upgrade to OCaml 5.5.1 or later to remediate this vulnerability. The vendor advisory confirms the fix was merged into the 5.5, 4.14, and trunk branches. No additional mitigations are indicated or required beyond applying the official patch.