CVE-2026-103635: CWE-125 Out-of-bounds read in Apache Software Foundation Apache DataSketches

CVE-2026-103635 is an out-of-bounds read vulnerability in the Apache DataSketches C++ library's compact Theta sketch deserialization functions (compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap()). These functions read header fields without first confirming the input length is sufficient. In the compressed format, a 32-bit overflow can bypass size checks, and two critical header fields controlling decoding lack validation. This flaw allows a crafted or truncated sketch to cause a read beyond the input buffer, potentially reading large amounts of memory and incorporating unintended bytes into the deserialized sketch. The vulnerability can cause application crashes (denial of service) and may expose adjacent memory contents. It affects versions >=3.1.0 and <=5.2.0 of Apache DataSketches C++. The issue is fixed in version 5.3.0.

Exploitation of this vulnerability can cause application crashes resulting in denial of service. Additionally, the out-of-bounds read may expose adjacent memory contents, potentially leaking sensitive information. The impact is limited to applications that deserialize Theta sketches from untrusted or malicious sources.

Users should upgrade Apache DataSketches C++ to version 5.3.0 or later, where this vulnerability is fixed. Until upgraded, avoid deserializing Theta sketches from untrusted or unauthenticated sources to prevent exploitation.