CVE-2026-103513

Apache DataSketches C++ has an out-of-bounds read and write in CPC sketch deserialization. A crafted serialized CPC sketch passed to cpc_sketch::deserialize() from a byte buffer or a stream can make the decompressor read past the end of the compressed data, because the read position is checked only after decoding finishes. In the hybrid flavor, unvalidated decoded row indices can also write outside an internal heap buffer, and other header and decoded values including lg_k are not validated. That can corrupt heap memory, crash the process, and potentially enable further exploitation. Only applications that deserialize CPC sketches from untrusted sources are affected, and no public proof of concept or in-the-wild exploitation is known.

What to do: Upgrade Apache DataSketches C++ to 5.3.0. Until then, do not pass CPC sketches from untrusted sources to cpc_sketch::deserialize(), and review any service that accepts serialized sketches over the network or from user-controlled storage.