CVE-2026-34353 is a Medium severity integer overflow vulnerability affecting OCaml versions through 4.14.3, specifically within the Bigarray.reshape function, which can lead to arbitrary memory reading when processing untrusted data. This vulnerability has a local attack vector and high attack complexity, potentially allowing an attacker to read sensitive information from memory. Rated with a CVSS score of 5.9, its primary impact is on confidentiality. Currently, there is no evidence of active exploitation, nor are public exploit tools like Metasploit or ExploitDB available. While it has received minimal community discussion, it is not listed in CISA's KEV catalog, indicating a low immediate threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 4.14.3CPE match | cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:* | ||
<= 4.14.3CPE matchmatch criteria | cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
ocaml: OCaml: Information disclosure via integer overflow in Bigarray.reshape
Mar 27, 2026In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.
Mar 10, 2026