Akshay-M-Singh/ocaml-marshal-vulnerability

PoC

I found an integer overflow that defeats OCaml's fix for CVE-2026-28364: heap memory disclosure and SIGBUS crashes via Marshal deserialization. PoCs, advisory, and proposed patch — fixed in OCaml 5.5.1 (OSEC-2026-18).

view exploit source poc_in_githubauthor Akshay-M-Singhpublished 2026-09-24catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2026-28364UShigh7.8Exploit
In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain. The…
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan