Threats tagged 'osec-2026-23'

Multiple issues in the OCaml Marshal module allow corrupted or malicious marshaled data to cause undefined behavior in the runtime system during unmarshaling. These issues include stale obj_counter usage, custom block size wraparound, and acceptance of forged Closure_tag metadata without validation. The vulnerability affects several OCaml versions and can lead to runtime corruption or code execution if untrusted data is unmarshaled. It is recommended to use Marshal only between trusted processes. Fixes have been merged in versions 4.14.5 and 5.5.2.