Four Apache DataSketches C++ deserialization out-of-bounds flaws

Apache disclosed four out-of-bounds bugs in datasketches-cpp deserialization that can corrupt memory or cause denial of service, with no exploitation reported.

On 10 October 2026, oss-security published four related advisories for Apache DataSketches C++ (datasketches-cpp), each affecting releases through 5.2.0 and none describing in-the-wild exploitation. CVE-2026-103513, rated moderate, is an out-of-bounds read and write in CPC sketch deserialization in versions 2.0.0-incubating through 5.2.0: a crafted sketch passed to cpc_sketch::deserialize() can make the decompressor read past the compressed data because the read position is not adequately checked, enabling memory corruption. CVE-2026-103634, also moderate and disclosed by Lee Rhodes, affects versions 4.1.0 through 5.2.0; count_min_sketch::deserialize() omitted the preamble from its input size check, so a truncated Count-Min sketch can read up to 16 bytes past the end, and a table size derived from attacker-controlled data can cause an out-of-bounds write and memory corruption. CVE-2026-103635, rated low, affects versions 3.1.0 through 5.2.0: compact Theta deserialization reads header fields before verifying that the input is long enough, and a 32-bit integer overflow can defeat the compressed-format size check, allowing denial of service. CVE-2026-103636, also low, affects versions 2.0.0-incubating through 5.2.0: var_opt_union::deserialize() checks that only 8 bytes are available and then reads a 32-byte preamble, so a truncated union can read up to 24 bytes past the input and cause denial of service. The four reports do not disagree on versions, severity, or impact.