What is CVE-2026-34353?

CVE-2026-34353 is a security advisory published by Microsoft Security Response Center (MSRC) with Medium severity. In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.

Which CVE IDs does CVE-2026-34353 cover?

CVE-2026-34353 covers the following CVE IDs: CVE-2026-34353. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of CVE-2026-34353?

CVE-2026-34353 has a CVSS v3 base score of 5.9, published by Microsoft Security Response Center (MSRC).

Which products are affected by CVE-2026-34353?

CVE-2026-34353 affects 4 products, including: azl3 ocaml 5.1.1-1 on Azure Linux 3.0; azl3 ocaml 5.1.1-2 on Azure Linux 3.0; cbl2 ocaml 4.13.1-2 on CBL Mariner 2.0; cbl2 ocaml 4.13.1-3 on CBL Mariner 2.0.

CVE-2026-34353MediumCVSS 5.9

In OCaml through 4.14.3, Bigarray.reshape allows an integer overflow, and resultant reading of arbitrary memory, when untrusted data is processed.

Vendor

Microsoft Security Response Center (MSRC)

Published

May 31, 2026

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2026-34353 →

🎯 Affected products4

azl3 ocaml 5.1.1-1 on Azure Linux 3.0
azl3 ocaml 5.1.1-2 on Azure Linux 3.0
cbl2 ocaml 4.13.1-2 on CBL Mariner 2.0
cbl2 ocaml 4.13.1-3 on CBL Mariner 2.0

✅ Remediation

KBCBL-Mariner Releases (Security Update) — fixed build 5.1.1-2 KBCBL-Mariner Releases (Security Update) — fixed build 4.13.1-3

🔗 References (2)

advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34353
referencehttps://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade