Bigarray.reshape integer overflow
The function `caml_ba_reshape`, part of the OCaml runtime (in runtime/bigarray.c), had a missing check for integer overflow when computing the size to be allocated. This leads to a segmentation fault. Any application using `Bigarray.reshape` (or `reshape_N`) with untrusted and unchecked input can result in a segmentation fault. ## Timeline - 2026-06-18 security advisory released - 2026-06-15 OCaml 4.14.4 released - 2026-04-16 Florian Angeletti backported the fix to the 4.14 branch - 2026-04-15 Stephen Dolan proposed fix https://github.com/ocaml/ocaml/pull/14691 - 2026-03-18 Andriy Sultanov reported https://github.com/ocaml/ocaml/issues/14655
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-34353US | medium5.1 | — | ||
In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed. | ||||
references
External citations — patches, advisories, analysis.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan