A critical buffer over-read vulnerability in the OCaml runtime enables remote code execution, posing a significant risk to applications processing untrusted serialized data.

This flaw is a buffer over-read occurring within the Marshal deserialization process in the runtime, specifically caused by missing bounds validation in the readblock function. An attacker can supply crafted Marshal data to trigger unbounded memory operations, which can be leveraged for remote code execution.

The ability for an attacker to achieve remote code execution represents a severe security compromise, potentially leading to full system takeover, unauthorized data access, and the execution of arbitrary code within the application context. Given the CVSS score of 7.9, this vulnerability is classified as High severity and requires immediate prioritization to prevent system compromise.

Immediate Action: Upgrade OCaml to version 4.14.3, 5.4.1, or later to incorporate the necessary bounds checking logic in the runtime.

Proactive Monitoring: Review application logs for unexpected crashes during data deserialization or anomalous memory usage patterns that may indicate attempts to exploit this buffer over-read.

Compensating Controls: Ensure that any applications utilizing the Marshal module do not accept serialized data from untrusted or unauthenticated external sources.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

This vulnerability is highly critical due to the potential for remote code execution via the core OCaml runtime. Security teams must treat this as a high priority and coordinate with development teams to update all OCaml dependencies to the patched versions immediately. Failure to patch leaves applications exposed to potential exploitation if they process untrusted Marshal data.