CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch
Apache DataSketches C++ CPC deserialization has an out-of-bounds flaw that can corrupt memory via a crafted sketch.
Apache disclosed CVE-2026-103513, a moderate out-of-bounds read and write in CPC sketch deserialization in datasketches-cpp. Affected versions are Apache DataSketches 2.0.0-incubating through 5.2.0. A crafted serialized CPC sketch passed to cpc_sketch::deserialize() from a byte buffer or stream can make the decompressor read past the end of the compressed data because the read position is not adequately checked, enabling memory corruption. No in-the-wild exploitation is described.
- CVE-2026-103513 affects datasketches-cpp 2.0.0-incubating through 5.2.0.
- Crafted CPC sketches passed to cpc_sketch::deserialize() cause out-of-bounds reads and writes.
- The decompressor can read past compressed data because the read position is insufficiently checked.
- Apache rates the issue moderate; no exploitation is reported.
- CVEs
- CVE-2026-103513
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103513 | Out-of-bounds read/write in DataSketches C++ CPC deserialization | 9.8 | — |
From the original article
Posted by Lee Rhodes on Oct 10 Severity: moderate Affected versions: - Apache DataSketches 2. 0. 0-incubating through 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.