Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). (CVE-2026-103635)

The vulnerability in Apache DataSketches C++ affects the deserialization of compact Theta sketches. Specifically, the functions compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields without sufficient input length validation. For compressed sketches, a 32-bit overflow can defeat size checks, and two critical header fields controlling decoding are not validated. This flaw allows crafted or truncated sketches to cause out-of-bounds reads, which can be large in the compressed case and may incorporate unintended bytes into the deserialized sketch. The impact includes potential application crashes (denial of service) and possible exposure of adjacent memory contents. The issue affects versions from 3.1.0 up to but not including 5.3.0. The vulnerability only impacts applications that deserialize Theta sketches from untrusted sources. The vendor recommends upgrading to version 5.3.0 to fix this vulnerability.

Exploitation of this vulnerability can cause application crashes resulting in denial of service. Additionally, it may expose adjacent memory contents, potentially leaking sensitive information. The risk is limited to applications that deserialize Theta sketches from untrusted or malicious sources.

Users should upgrade Apache DataSketches C++ to version 5.3.0 or later, where this vulnerability has been fixed. There are no vendor advisories indicating alternative mitigations or that no action is required. Until upgrading, avoid deserializing Theta sketches from untrusted sources.