CVE-2026-123274: Apache DataSketches C++: Out-of-bounds write in KLL sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a KLL sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized level boundaries were not validated.
This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.3.1
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Applications using Apache DataSketches C++ versions 2.0.0 through 5.3.0 are exposed if they deserialize KLL sketches obtained from an untrusted source. The issue is triggered during KLL sketch deserialization, not merely by using the library.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted serialized KLL sketch that the application deserializes. The crafted sketch uses invalid serialized level boundaries, leading to heap memory corruption.
What should teams do if they use an affected version?
Upgrade Apache DataSketches C++ to version 5.3.1, which fixes the validation issue. Until upgrading, avoid deserializing KLL sketches from untrusted sources.