An integer overflow occurs in OCaml's Bigarray.reshape function when processing untrusted data, allowing the program to read memory beyond intended bounds. This flaw can expose sensitive information from the process's address space, representing a moderate confidentiality breach. No direct execution or denial‑of‑service effect is claimed, but the ability to read arbitrary memory increases the attack surface significantly.

Unpatched OCaml versions up to and including 4.14.3 are affected. The issue was identified in the OCaml toolchain, specifically the Bigarray library. Updating to versions released after the patch in the referenced pull request eliminates the vulnerability.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to provide crafted input to a program that uses OCaml's Bigarray.reshape. While the attack vector is likely local or within a controlled environment, any application that processes untrusted data with OCaml remains at risk until patched.