osec-2026-22

{
  "affected": [
    {
      "database_specific": {
        "source": "https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-22.json"
      },
      "ecosystem_specific": {
        "affected_bindings": [
          "Unix.map_file"
        ],
        "opam_constraint": "ocaml {< \"5.5.2\"}"
      },
      "package": {
        "ecosystem": "opam",
        "name": "ocaml",
        "purl": "pkg:opam/ocaml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "de57bb4f59c3302260aaeaaa4dfee12695597d25"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "ff978d2139ba638886c2565f2d86c0ee265840a5"
            }
          ],
          "repo": "https://github.com/ocaml/ocaml",
          "type": "GIT"
        }
      ],
      "versions": [
        "3.07",
        "3.07+1",
        "3.07+2",
        "3.08.0",
        "3.08.1",
        "3.08.2",
        "3.08.3",
        "3.08.4",
        "3.09.0",
        "3.09.1",
        "3.09.2",
        "3.09.3",
        "3.10.0",
        "3.10.1",
        "3.10.2",
        "3.11.0",
        "3.11.1",
        "3.11.2",
        "3.12.0",
        "3.12.1",
        "4.00.0",
        "4.00.1",
        "4.01.0",
        "4.02.0",
        "4.02.1",
        "4.02.2",
        "4.02.3",
        "4.02.4",
        "4.03.0",
        "4.03.1",
        "4.04.0",
        "4.04.1",
        "4.04.2",
        "4.04.3",
        "4.05.0",
        "4.05.1",
        "4.06.0",
        "4.06.1",
        "4.06.2",
        "4.07.0",
        "4.07.1",
        "4.07.2",
        "4.08.0",
        "4.08.1",
        "4.08.2",
        "4.09.0",
        "4.09.1",
        "4.09.2",
        "4.10.0",
        "4.10.1",
        "4.10.2",
        "4.10.3",
        "4.11.0",
        "4.11.1",
        "4.11.2",
        "4.11.3",
        "4.12.0",
        "4.12.1",
        "4.12.2",
        "4.13.0",
        "4.13.1",
        "4.13.2",
        "4.14.0",
        "4.14.1",
        "4.14.2",
        "4.14.3",
        "4.14.4",
        "4.14.5",
        "5.0.0",
        "5.0.1",
        "5.1.0",
        "5.1.1",
        "5.1.2",
        "5.2.0",
        "5.2.1",
        "5.2.2",
        "5.3.0",
        "5.3.1",
        "5.4.0",
        "5.4.1",
        "5.4.2",
        "5.5.0",
        "5.5.1",
        "flambda_fork_point",
        "5.5.0-rc1",
        "5.5.0-beta1",
        "5.5.0-alpha3",
        "5.5.0-alpha2",
        "5.5.0-alpha1"
      ]
    }
  ],
  "credits": [
    {
      "name": "Anthropic",
      "type": "REPORTER"
    },
    {
      "name": "Hannes Mehnert",
      "type": "COORDINATOR"
    },
    {
      "name": "Edwin Török",
      "type": "COORDINATOR"
    },
    {
      "name": "Nicolás Ojeda Bär",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Edwin Török",
      "type": "REMEDIATION_REVIEWER"
    },
    {
      "name": "Xavier Leroy",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "database_specific": {
    "cwe": [
      "CWE-190"
    ],
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-22.md",
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-22.json"
  },
  "details": "ANT-2026-6W9NPC2Q mmap dimension product integer overflow\n\n\n## Fix\n\nUse `caml_umul_overflow` instead of `*` when multiplying bigarray dimensions, which detects integer overflows and raise `Failure`.\nNegative positions are also rejected by raising `Invalid_argument`.\n\n## Am I affected?\n\nIf either the dimensions or the file size in a call to `Unix.map_file` from your code is user controllable then you are potentially affected.\n\n## Score notes\n\nThe vulnerability is in a library, and the CVSS score is calculated [under worst case assumptions](https://www.first.org/cvss/v4.0/user-guide#Assessing-Vulnerabilities-in-Software-Libraries-and-Similar). For an actual application the score will depend on how much an attacker can control the input to this function (if at all).\n\n\n## Timeline\n\n- 2026-08-24: vulnerability was found\n- 2026-08-27: forwarded report to security@ocaml.org\n- 2026-09-29: fix merged to trunk",
  "id": "OSEC-2026-22",
  "modified": "2026-10-23T22:15:04.873103440Z",
  "published": "2026-10-23T21:30:00Z",
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Integer overflow in Unix.map_file"
}