Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). (CVE-2026-103513)

The vulnerability in Apache DataSketches C++ arises during the deserialization of CPC sketches via cpc_sketch::deserialize(). A crafted serialized CPC sketch can cause the decompressor to read past the end of compressed data because the read position is only checked after decoding completes. In the hybrid flavor, unchecked decoded row indices can cause writes outside an internal heap buffer. Additional header fields and decoded values, including lg_k, are not validated, leading to potential heap corruption. This affects versions from 2.0.0-incubating before 5.3.0 and impacts only applications deserializing CPC sketches from untrusted sources. The issue is fixed in version 5.3.0.

Heap memory corruption caused by out-of-bounds read and write during CPC sketch deserialization can result in application crashes and may enable further exploitation. The impact is limited to applications that deserialize CPC sketches from untrusted sources. No known exploits are reported in the wild.

Upgrade Apache DataSketches C++ to version 5.3.0 or later, where this vulnerability is fixed. Only applications that deserialize CPC sketches from untrusted sources are affected, so limiting deserialization to trusted inputs can also reduce risk.