CVE-2026-103513

Name of the Vulnerable Software and Affected Versions Apache DataSketches C++ versions 2.0.0-incubating through 5.2.9

Description An out-of-bounds read and write occurs during the deserialization of CPC sketches. A crafted serialized CPC sketch passed to the cpc sketch::deserialize() function, whether from a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data because the read position is only verified after decoding is complete. In the hybrid flavor, this can lead to a write operation outside an internal heap buffer due to a lack of validation for decoded row indices. Additionally, several header fields and decoded values, such as lg k, are not validated. This can result in heap memory corruption, leading to system crashes or potential further exploitation. This issue specifically affects applications that deserialize CPC sketches from untrusted sources.

Recommendations Upgrade to version 5.3.0.