Technical impact
The cstruct package for OCaml before version 6.3.0 contains a flaw that mishandles indexes, allowing untrusted data to exceed expected bounds. This weakness can lead to memory corruption, potentially allowing an attacker to corrupt data structures or trigger a crash, thereby affecting confidentiality, integrity, or availability of the affected application. The identified weakness aligns with CWE-573, which describes scenarios where input data is not properly validated as a buffer offset.
Affected Systems
OCaml cstruct libraries with versions prior to 6.3.0 are vulnerable. Systems that compile or link against these older releases may be at risk if they process untrusted input that includes out‑of‑range indexes. Precise product or version details beyond the stated 6.3.0 cutoff are not provided in the advisory.
Risk and Exploitability
The CVSS score of 7.3 indicates a high severity vulnerability. No EPSS score is CISA KEV catalog. Exploitation would require an attacker to supply crafted input that triggers the out‑of‑bounds operation; the exact attack vector and conditions are not detailed, so the risk assessment relies on the high CVSS score and the potential for memory corruption.
