{"id":"CVE-2026-103636","published":"2026-10-10T11:17:36.077","lastModified":"2026-10-16T16:16:53.970","description":"Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp).\n\nvar_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. For such inputs, the size remaining for the embedded sketch was also computed by an unsigned subtraction that could wrap around, so the embedded sketch's own size checks no longer limited reads to the input. The bytes read can become part of the deserialized union's state. This can cause a crash (denial of service) and could expose adjacent memory contents.\n\nThis issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize VarOpt unions from untrusted sources are affected.\n\nUsers are recommended to upgrade to version 5.3.0, which fixes this issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-125","CWE-191"],"vendors":[],"products":[],"references":[{"url":"https://github.com/apache/datasketches-cpp/releases/tag/5.3.0","tags":[]},{"url":"https://lists.apache.org/thread/znn94s463w7wy125khcywxsp82y2qkq5","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/10/6","tags":[]}],"exploitRefs":[{"url":"https://github.com/apache/datasketches-cpp/releases/tag/5.3.0","tags":[]}],"hasPoc":true,"ai":{"summary":"An out-of-bounds read vulnerability exists in Apache DataSketches C++ when deserializing VarOpt unions, allowing attackers to read up to 24 bytes past the end of input data and potentially expose adjacent memory contents. This can lead to denial of service or information disclosure.","exploitability":"Exploitation is moderately difficult as it requires crafting a specially truncated serialized union that triggers the out-of-bounds read, but does not require user interaction or specific privileges.","blast_radius":"The impact is limited to applications that deserialize VarOpt unions from untrusted sources, which could affect data processing pipelines and analytics systems that handle external sketch data.","remediation":"Upgrade to version 5.3.0, which fixes this out-of-bounds read vulnerability in VarOpt union deserialization.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["memory-corruption","deserialization","denial-of-service"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:12:12.292Z"}}