He Huang

**Name of the Vulnerable Software and Affected Versions** Apache DataSketches C++ versions 2.0.0-incubating through 5.2.9 **Description** An out-of-bounds read and write occurs during the deserialization of CPC sketches. A crafted serialized CPC sketch passed to the `cpc sketch::deserialize()` function, whether from a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data because the read position is only verified after decoding is complete. In the hybrid flavor, this can lead to a write operation outside an internal heap buffer due to a lack of validation for decoded row indices. Additionally, several header fields and decoded values, such as `lg k`, are not validated. This can result in heap memory corruption, leading to system crashes or potential further exploitation. This issue specifically affects applications that deserialize CPC sketches from untrusted sources. **Recommendations** Upgrade to version 5.3.0.

**Name of the Vulnerable Software and Affected Versions** Apache DataSketches C++ versions 3.1.0 through 5.2.9 **Description** An out-of-bounds read exists during the deserialization of compact Theta sketches. The functions `compact theta sketch::deserialize()` and `wrapped compact theta sketch::wrap()` read header fields without verifying if the input length is sufficient. In the compressed format, a 32-bit overflow can bypass size checks, and two header fields controlling decoding are not validated, which also impacts stream deserialization. A crafted or truncated sketch can trigger a read past the end of the input, potentially causing a crash (denial of service) or exposing adjacent memory contents. This issue specifically affects applications that deserialize Theta sketches from untrusted sources. **Recommendations** Upgrade to version 5.3.0.

**Name of the Vulnerable Software and Affected Versions** Apache DataSketches C++ versions 2.0.0-incubating through 5.2.9 **Description** An out-of-bounds read exists in the VarOpt union deserialization process. The `var opt union::deserialize()` function reads a 32-byte preamble from a non-empty union even when only 8 bytes are available, potentially reading up to 24 bytes beyond the input end. Additionally, an unsigned subtraction used to calculate the remaining size for the embedded sketch can wrap around, bypassing subsequent size checks. This allows bytes from adjacent memory to be incorporated into the deserialized union state, which may lead to a crash (denial of service) or the exposure of memory contents. This issue specifically affects applications that deserialize VarOpt unions from untrusted sources. **Recommendations** Upgrade to version 5.3.0.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 156 Thunderbird versions prior to 156 **Description** A denial-of-service issue exists within the Audio/Video component. **Recommendations** Update Firefox to version 156. Update Thunderbird to version 156.