CVE-2026-103513: CWE-787 Out-of-bounds write in Apache Software Foundation Apache DataSketches

The vulnerability exists in the cpc_sketch::deserialize() function of Apache DataSketches C++ where a crafted serialized CPC sketch can cause out-of-bounds reads and writes. The decompressor reads past the end of compressed data because the read position is only checked after decoding finishes. In the hybrid flavor, decoded row indices are not validated, leading to writes outside an internal heap buffer. Additional header fields and decoded values, including lg_k, are also not validated, resulting in heap memory corruption. This affects versions >=2.0.0-incubating and <=5.2.0. The issue is resolved in version 5.3.0.

Heap memory corruption caused by out-of-bounds read and write can lead to application crashes and may enable further exploitation if an attacker supplies crafted serialized CPC sketches to vulnerable applications that deserialize untrusted input.

Users should upgrade Apache DataSketches C++ to version 5.3.0 or later, which contains the official fix for this vulnerability. Only applications that deserialize CPC sketches from untrusted sources are affected, so limiting input sources can reduce risk.