The vulnerability originates from missing bounds checking in OCaml's readblock() routine used during Marshal deserialization. When an attacker supplies crafted Marshal data, the routine performs memcpy calls with lengths derived from that data, causing an out‑of‑bounds read and an unchecked memory copy. This flaw enables an attacker to execute arbitrary code with the privileges of the running OCaml process. The weakness is classified as a buffer over‑read (CWE‑125) and an unchecked memory copy (CWE‑126).

OCaml versions before 4.14.3 and 5.x before 5.4.1 are impacted. The issue affects the runtime component that many applications rely on for deserializing data received from external sources. Any deployment that uses the default Marshal module to process untrusted input is at risk, regardless of the operating environment.

The CVSS score of 7.9 indicates a high severity, while the EPSS score indicates the likelihood of current exploitation is very low but not zero. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exfiltration requires an attacker to deliver a specifically crafted Marshal payload to the vulnerable application, typically through a network or file channel. The multi‑phase attack chain relies on the unchecked memory copy performed during deserialization, and a successful exploit would allow the attacker to run arbitrary code on the host with the same privileges as the OCaml runtime.