Disclosure summary
Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize(), from either a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data, because the read position was only checked after decoding finished. In the hybrid flavor, it can also cause a write outside an internal heap buffer, because decoded row indices were not validated. Several other header fields and decoded values, including lg_k, were also not validated. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize CPC sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
Source-reported weakness categories
CWE-125, CWE-787
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
CVEProject/cvelistV5 releases · RSS-2b11a7e1dade072c26c14342ed52b8ffeb8
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_2300Z
CVE mention in publisher metadata; check the original affected versions.
CVEProject/cvelistV5 releases · RSS-f946067cb6a34653c12f3a7d3e105773b0f
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_2200Z
CVE mention in publisher metadata; check the original affected versions.
CVEProject/cvelistV5 releases · RSS-7c1aa4e02ee105026a9d5ef835739da2231
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_2100Z
CVE mention in publisher metadata; check the original affected versions.
CVEProject/cvelistV5 releases · RSS-5daad76275e9590636f1bfed69854f874d0
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_2000Z
CVE mention in publisher metadata; check the original affected versions.
CVEProject/cvelistV5 releases · RSS-f5a41e504aba4034d4f99f9de25577fb6a1
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_1900Z
CVE mention in publisher metadata; check the original affected versions.
CVEProject/cvelistV5 releases · RSS-f5dee9e139662097b84b17b3e74d5544c25
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_1800Z
CVE mention in publisher metadata; check the original affected versions.
CVEProject/cvelistV5 releases · RSS-6729502a4ea3125ddd379f75d3eb8cb63a6
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_1700Z
CVE mention in publisher metadata; check the original affected versions.
CVEProject/cvelistV5 releases · RSS-a10ecc85ff20aad80a7e8436dd92befdcfc
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_1600Z
CVE mention in publisher metadata; check the original affected versions.
CVEProject/cvelistV5 releases · RSS-5f26de48c2d7605f54c0980f1221b67644b
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_1500Z
CVE mention in publisher metadata; check the original affected versions.
CVEProject/cvelistV5 releases · RSS-95eb7d8256449b8a75dc66291b65bfe37a2
Open original source · Updated Oct 10, 2026
CVE 2026-10-10_1400Z
CVE mention in publisher metadata; check the original affected versions.
NIST National Vulnerability Database · NVD-CVE-2026-103513
Open original source · Updated Oct 10, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Original records & references
PUBLISHED 2026-10-10T07:17:35-04:00
MODIFIED 2026-10-10T09:17:30-04:00
INGESTED 2026-10-10T20:55:17-04:00