CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).
A crafted serialized CPC sketch passed to cpcsketch::deserialize(), from either a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data, because the read position was only checked after decoding finished. In the hybrid flavor, it can also cause a write outside an internal heap buffer, because decoded row indices were not validated. Several other header fields and decoded values, including lgk, were also not validated. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.
This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize CPC sketches from untrusted sources are affected.
Users are recommended to upgrade to version 5.3.0, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache DataSketches C++ (datasketches-cpp)to a version that resolves this vulnerability.Fixed in 5.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only applications using affected Apache DataSketches C++ versions that deserialize CPC sketches from untrusted sources are affected. The affected version range is from 2.0.0-incubating before 5.3.0.
What must an attacker provide to trigger the vulnerability?
An attacker needs to supply a crafted serialized CPC sketch that the application passes to cpc_sketch::deserialize(), either from a byte buffer or a stream. The malformed sketch can drive out-of-bounds reads and, in the hybrid flavor, writes outside an internal heap buffer.
What is the recommended remediation?
Upgrade Apache DataSketches C++ to version 5.3.0. This release fixes the missing validation of compressed-data bounds, row indices, header fields, and decoded values including lg_k.