Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-34353

20
FAUCET Score

CVE-2026-34353 is a Medium severity integer overflow vulnerability affecting OCaml versions through 4.14.3, specifically within the Bigarray.reshape function, which can lead to arbitrary memory reading when processing untrusted data. This vulnerability has a local attack vector and high attack complexity, potentially allowing an attacker to read sensitive information from memory. Rated with a CVSS score of 5.9, its primary impact is on confidentiality. Currently, there is no evidence of active exploitation, nor are public exploit tools like Metasploit or ExploitDB available. While it has received minimal community discussion, it is not listed in CISA's KEV catalog, indicating a low immediate threat.

Impacted Technologies

VendorProductVersion(s)CPE
>= 0, <= 4.14.3CPE match
cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*
<= 4.14.3CPE matchmatch criteria
cpe:2.3:a:ocaml:ocaml:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.9MEDIUM

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
1.4
Impact Score
4.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.11%
Probability of exploitation in next 30 days
EPSS Percentile
1.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0011 is in the 1st percentile among its peer group of 1,595 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (13)

microsoftpatch availablevia msrc
Product: cbl2 ocaml 4.13.1-3 on CBL Mariner 2.0Fixed in: 4.13.1-3
microsoftpatch availablevia msrc
Product: 21039-17086Fixed in: 4.13.1-3
microsoftpatch availablevia msrc
Product: 21151-17086Fixed in: 4.13.1-3
microsoftpatch availablevia msrc
Product: azl3 ocaml 5.1.1-1 on Azure Linux 3.0Fixed in: 5.1.1-2
microsoftpatch availablevia msrc
Product: azl3 ocaml 5.1.1-2 on Azure Linux 3.0Fixed in: 5.1.1-2
microsoftpatch availablevia msrc
Product: cbl2 ocaml 4.13.1-2 on CBL Mariner 2.0Fixed in: 4.13.1-3
microsoftpatch availablevia msrc
Product: 20930-17084Fixed in: 5.1.1-2
microsoftpatch availablevia msrc
Product: 21150-17084Fixed in: 5.1.1-2
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: ocaml
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: ocaml
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: ocaml
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: ocaml
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 10Fixed in: ocaml

Vendor Advisories (2)

redhatCVE-2026-34353Moderate

ocaml: OCaml: Information disclosure via integer overflow in Bigarray.reshape

Mar 27, 2026
microsoft2026-Mar/CVE-2026-34353Moderate

In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.

Mar 10, 2026

References

github.com / ocaml/ocaml/issues/14655
Issue Tracking
github.com / ocaml/ocaml/pull/14674
Issue Tracking