CVE-2026-123338: Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized compactor headers were not validated.
This issue affects Apache DataSketches C++: from 3.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache DataSketches C++to a version that resolves this vulnerability.Fixed in 5.3.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using Apache DataSketches C++ versions 3.0.0 through 5.3.0 are affected if they deserialize REQ sketches obtained from an untrusted source.
What does an attacker need to exploit the vulnerability?
An attacker needs to supply a crafted serialized REQ sketch that the application deserializes. The malformed compactor headers can then trigger an out-of-bounds write and corrupt heap memory.
What should be done to remediate the issue?
Upgrade Apache DataSketches C++ to version 5.3.1, which fixes the missing validation of serialized compactor headers.