CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch
Apache DataSketches C++ 4.1.0–5.2.0 has an out-of-bounds read and write in Count-Min sketch deserialization.
Lee Rhodes disclosed CVE-2026-103634, a moderate out-of-bounds read and write in Apache DataSketches C++ (datasketches-cpp) versions 4.1.0 through 5.2.0. count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated Count-Min sketch can read up to 16 bytes past the end of the input. The table size is also derived from attacker-controlled data, enabling memory corruption via a crafted sketch. No in-the-wild exploitation is reported.
- CVE-2026-103634 affects Apache DataSketches C++ 4.1.0 through 5.2.0.
- Count-Min sketch deserialize() omitted the preamble from its input size check.
- A truncated sketch can read up to 16 bytes past the input end.
- The issue also includes an out-of-bounds write that can corrupt memory.
- Apache rates the vulnerability moderate.
- CVEs
- CVE-2026-103634
- Vendors
- Apache
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103634 | Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo | 5.3 | — |
From the original article
Posted by Lee Rhodes on Oct 10 Severity: moderate Affected versions: - Apache DataSketches 4. 1. 0 through 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.