Out-of-bounds read in Apache DataSketches C++ Theta sketches
Apache DataSketches C++ has an out-of-bounds read in compact Theta sketch deserialization. compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before confirming the input is long enough; for the compressed format a 32-bit overflow can defeat the size check, two decoding-control header fields are not validated, and stream deserialization is affected as well. A crafted or truncated sketch can read past the end of the input—sometimes by a large amount in the compressed case—and those bytes can be incorporated into the deserialized sketch, causing a crash (denial of service) and potentially exposing adjacent memory. Only applications that deserialize Theta sketches from untrusted sources, using versions from 3.1.0 before 5.3.0, are affected. There is no known public proof of concept and no evidence of exploitation in the wild; the issue is fixed in 5.3.0.
What to do: Upgrade Apache DataSketches C++ to 5.3.0. Until then, do not deserialize compact or compressed Theta sketches from untrusted or truncated inputs, including streams, and treat sketch bytes from external sources as untrusted.
| Product | Affected |
|---|---|
| Apache DataSketches C++ (datasketches-cpp) | 3.1.0 before 5.3.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking that the input was long enough. For the compressed format, the size check could be defeated by a 32-bit overflow, and two header fields that control decoding were not validated; this also affected deserialization from a stream. A crafted or truncated sketch could cause a read past the end of the input. In the compressed case the over-read can be large, and the bytes read can become part of the deserialized sketch. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 3.1.0 before 5.3.0. Only applications that deserialize Theta sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
CVE-2026-103635 lets crafted compact Theta sketches trigger an out-of-bounds read in Apache DataSketches C++.
Today 656 readers · 803 views · 606 reads · all time 158K views