{"id":"OSEC-2026-22","summary":"Integer overflow in Unix.map_file","details":"ANT-2026-6W9NPC2Q mmap dimension product integer overflow\n\n\n## Fix\n\nUse `caml_umul_overflow` instead of `*` when multiplying bigarray dimensions, which detects integer overflows and raise `Failure`.\nNegative positions are also rejected by raising `Invalid_argument`.\n\n## Am I affected?\n\nIf either the dimensions or the file size in a call to `Unix.map_file` from your code is user controllable then you are potentially affected.\n\n## Score notes\n\nThe vulnerability is in a library, and the CVSS score is calculated [under worst case assumptions](https://www.first.org/cvss/v4.0/user-guide#Assessing-Vulnerabilities-in-Software-Libraries-and-Similar). For an actual application the score will depend on how much an attacker can control the input to this function (if at all).\n\n\n## Timeline\n\n- 2026-08-24: vulnerability was found\n- 2026-08-27: forwarded report to security@ocaml.org\n- 2026-09-29: fix merged to trunk","modified":"2026-10-23T22:15:03.186449389Z","published":"2026-10-23T21:30:00Z","database_specific":{"cwe":["CWE-190"],"osv":"https://github.com/ocaml/security-advisories/tree/generated-osv/2026/OSEC-2026-22.json","human_link":"https://github.com/ocaml/security-advisories/tree/main/advisories/2026/OSEC-2026-22.md"},"affected":[{"package":{"name":"ocaml","ecosystem":"opam","purl":"pkg:opam/ocaml"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.5.2"}]},{"type":"GIT","repo":"https://github.com/ocaml/ocaml","events":[{"introduced":"0"},{"fixed":"de57bb4f59c3302260aaeaaa4dfee12695597d25"}]},{"type":"GIT","repo":"https://github.com/ocaml/ocaml","events":[{"introduced":"0"},{"fixed":"ff978d2139ba638886c2565f2d86c0ee265840a5"}]}],"versions":["3.07","3.07+1","3.07+2","3.08.0","3.08.1","3.08.2","3.08.3","3.08.4","3.09.0","3.09.1","3.09.2","3.09.3","3.10.0","3.10.1","3.10.2","3.11.0","3.11.1","3.11.2","3.12.0","3.12.1","4.00.0","4.00.1","4.01.0","4.02.0","4.02.1","4.02.2","4.02.3","4.02.4","4.03.0","4.03.1","4.04.0","4.04.1","4.04.2","4.04.3","4.05.0","4.05.1","4.06.0","4.06.1","4.06.2","4.07.0","4.07.1","4.07.2","4.08.0","4.08.1","4.08.2","4.09.0","4.09.1","4.09.2","4.10.0","4.10.1","4.10.2","4.10.3","4.11.0","4.11.1","4.11.2","4.11.3","4.12.0","4.12.1","4.12.2","4.13.0","4.13.1","4.13.2","4.14.0","4.14.1","4.14.2","4.14.3","4.14.4","4.14.5","5.0.0","5.0.1","5.1.0","5.1.1","5.1.2","5.2.0","5.2.1","5.2.2","5.3.0","5.3.1","5.4.0","5.4.1","5.4.2","5.5.0","5.5.1","flambda_fork_point","5.5.0-rc1","5.5.0-beta1","5.5.0-alpha3","5.5.0-alpha2","5.5.0-alpha1"],"ecosystem_specific":{"opam_constraint":"ocaml {\u003c \"5.5.2\"}","affected_bindings":["Unix.map_file"]},"database_specific":{"source":"https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-22.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:P"}],"credits":[{"name":"Anthropic","type":"REPORTER"},{"name":"Hannes Mehnert","type":"COORDINATOR"},{"name":"Edwin Török","type":"COORDINATOR"},{"name":"Nicolás Ojeda Bär","type":"REMEDIATION_REVIEWER"},{"name":"Edwin Török","type":"REMEDIATION_REVIEWER"},{"name":"Xavier Leroy","type":"REMEDIATION_DEVELOPER"}]}