Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). (CVE-2026-103501)

The vulnerability (CVE-2026-103501) in Apache DataSketches C++ occurs during deserialization of HLL sketches in LIST mode. The coupon count read from the input is used unchecked to copy entries into a fixed internal heap buffer of 8 entries, allowing a crafted input to overflow this buffer by up to 988 bytes. This heap buffer overflow can corrupt memory, leading to application crashes and possibly enabling further exploitation. The affected versions are from 1.0.0-incubating up to but not including 5.3.0. The issue is relevant only when deserializing sketches from untrusted sources. The vendor fixed the issue in version 5.3.0.

Heap memory corruption caused by the buffer overflow can result in application crashes and may allow attackers to execute further exploits depending on the context of use. The impact is limited to applications that deserialize HLL sketches from untrusted or malicious sources.

Users should upgrade Apache DataSketches C++ to version 5.3.0 or later, where this vulnerability is fixed. Avoid deserializing HLL sketches from untrusted sources until the upgrade is applied.