A heap buffer overflow vulnerability exists in the OCaml runtime_events consumer when parsing an oversized custom user event. This occurs due to a corrupt stream containing a valid message with one message type followed by the same event with a different message type, which can cause a crash. The issue is relevant if the runtime events producer and consumer run in separate processes and the producer can be tricked into producing malformed data. A fix has been merged to the OCaml trunk and is available in version 5.5.2.