CVE-2026-89087

cstruct, an OCaml library used to parse C-style binary data structures, mishandles indexes in all versions before 6.3.0 (CWE-573, improper following of specification by caller). Because cstruct is typically invoked on network-supplied data, an unauthenticated remote attacker can trigger the faulty index handling by sending crafted input to an application that parses it with an affected version. Per the CVSS 3.1 score of 7.3 with low confidentiality, integrity, and availability impacts, the concrete outcome depends on how each application uses the library, but does not indicate a high-severity code-execution or full system compromise. Anyone building or running OCaml software that depends on cstruct — including MirageOS-based unikernel deployments, which commonly rely on this library for network protocol parsing — is affected. There is no public proof of concept, the issue is not in CISA's KEV, and no in-the-wild exploitation is currently known.

What to do: Upgrade cstruct to 6.3.0 or later via opam, then rebuild and redeploy every dependent package, application, or MirageOS unikernel image so the fixed version is actually linked in. Audit resolved dependency versions in your opam switches and lockfiles (e.g., with 'opam list' or dependency pinning) to confirm no pre-6.3.0 cstruct remains in production builds. Since exploitation status is currently 'none known' and details are sparse, prioritize internet-facing OCaml services and watch for updated advisories.