CVE-2026-89087
Received Received - Intake

Integer Overflow in OCaml cstruct Package

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: MITRE

Description
The cstruct package before 6.3.0 for OCaml mishandles indexes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-11
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-89087
EUVD
EUVD-2026-75709

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-573 The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The cstruct package before version 6.3.0 for OCaml has a flaw in how it handles indexes. This could lead to incorrect memory access or data corruption when processing structured data.

Impact Analysis

This vulnerability may allow attackers to read or modify sensitive data, cause crashes, or execute arbitrary code if exploited. Systems using affected versions of cstruct could be at risk of data breaches or service disruptions.

Compliance Impact

The vulnerability in the cstruct package may lead to unauthorized data access or modification due to improper index handling, which could violate confidentiality and integrity requirements in GDPR and HIPAA. However, specific compliance impacts depend on system implementation and data processing context.

Mitigation Strategies

Update the cstruct package to version 6.3.0 or later to address the index mishandling issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89087. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart