CVE-2026-103636

Apache DataSketches C++ from 2.0.0-incubating before 5.3.0 has an out-of-bounds read in var_opt_union::deserialize(). After confirming that only 8 bytes are available, the function still reads a 32-byte preamble of a non-empty union, so a truncated serialized union can read up to 24 bytes past the end of the input. An unsigned subtraction used to size the embedded sketch can wrap, so the sketch's own checks no longer limit reads to the buffer, and the bytes read can become part of the deserialized union's state. That can crash the process (denial of service) and may expose adjacent memory. Only applications that deserialize VarOpt unions from untrusted sources are affected, and no public proof of concept or in-the-wild exploitation is known.

What to do: Upgrade Apache DataSketches C++ to 5.3.0. Until then, do not deserialize VarOpt unions from untrusted or truncated sources, and reject inputs shorter than a complete non-empty union before calling deserialize().