CVE-2026-103634

Published: Ott 22, 2026 Last Modified: Ott 22, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).

count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic. A crafted sketch could make it wrap to zero, so that the sketch deserialized with an empty table, and later updates and estimate queries read and wrote outside the heap allocation. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.

This issue affects Apache DataSketches C++: from 4.1.0 before 5.3.0. Only applications that deserialize Count-Min sketches from untrusted sources are affected.

Users are recommended to upgrade to version 5.3.0, which fixes this issue.

190

Integer Overflow or Wraparound

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality Access Control Other
Potential Impacts:
Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Memory) Dos: Instability Modify Memory Execute Unauthorized Code Or Commands Bypass Protection Mechanism Alter Execution Logic Dos: Resource Consumption (Cpu)
Applicable Platforms
Languages: Not Language-Specific, C
Likelihood of Exploit: Medium
View CWE Details
787

Out-of-bounds Write

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Availability Other
Potential Impacts:
Modify Memory Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Unexpected State
Applicable Platforms
Languages: Memory-Unsafe, C, C++, Assembly
Technologies: ICS/OT
Likelihood of Exploit: High
View CWE Details
https://github.com/apache/datasketches-cpp/releases/tag/5.3…
https://github.com/apache/datasketches-cpp/releases/tag/5.3.0
https://lists.apache.org/thread/rkx9oh06g5cjc6vmmpqloxwfz0g…
https://lists.apache.org/thread/rkx9oh06g5cjc6vmmpqloxwfz0gzz01h