Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). (CVE-2026-103636)

The vulnerability in Apache DataSketches C++ arises from the var_opt_union::deserialize() function reading a 32-byte preamble after verifying only 8 bytes are available, leading to an out-of-bounds read of up to 24 bytes past the input end. Additionally, an unsigned subtraction used to compute the remaining size for the embedded sketch can wrap around, bypassing size checks and allowing further out-of-bounds reads. This can result in memory disclosure or a denial of service via crash. The issue affects versions from 2.0.0-incubating before 5.3.0 and only impacts applications deserializing VarOpt unions from untrusted inputs.

Exploitation can cause application crashes (denial of service) and may expose adjacent memory contents, potentially leaking sensitive information. The impact is limited to scenarios where untrusted serialized VarOpt unions are deserialized.

Users should upgrade to Apache DataSketches C++ version 5.3.0 or later, which contains the fix for this vulnerability. No other mitigations are indicated. Patch status is confirmed by the vendor recommendation to upgrade to 5.3.0.