CVE-2026-103636: CWE-125 Out-of-bounds read in Apache Software Foundation Apache DataSketches

CVE-2026-103636 is an out-of-bounds read vulnerability in the Apache DataSketches C++ library's VarOpt union deserialization method. The function var_opt_union::deserialize() incorrectly reads a 32-byte preamble after verifying only 8 bytes are available, allowing reads up to 24 bytes past the input end if the serialized union is truncated. Additionally, an unsigned subtraction used to compute the embedded sketch size can wrap around, bypassing size checks and enabling further out-of-bounds reads. These reads can corrupt the deserialized union's state, cause crashes, and potentially expose adjacent memory contents. The vulnerability affects versions >=2.0.0-incubating and <=5.2.0 and is resolved in version 5.3.0.

Exploitation of this vulnerability can cause application crashes resulting in denial of service. It may also lead to exposure of adjacent memory contents, which could include sensitive information. The impact is limited to applications that deserialize VarOpt unions from untrusted sources. There are no known exploits in the wild at this time.

Users should upgrade Apache DataSketches C++ to version 5.3.0 or later, where this vulnerability is fixed. Only applications that deserialize VarOpt unions from untrusted sources are affected, so restricting input sources can also reduce risk. Patch status is confirmed fixed in version 5.3.0.