CVE-2026-103501

Undergoing Analysis Undergoing Analysis - In Progress

Heap Buffer Overflow in Apache DataSketches C++ HLL Sketch Deserialization

Publication date: 2026-10-10

Last updated on: 2026-10-16

Assigner: Apache Software Foundation

Description

Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of entries to copy into a fixed buffer of 8 entries, without checking it against the buffer's capacity. A crafted sketch could cause a write of up to 988 bytes past the end of this internal heap buffer. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. This issue affects Apache DataSketches C++: from 1.0.0-incubating before 5.3.0. Only applications that deserialize HLL sketches from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103501

EUVD

EUVD-2026-96306

Affected Vendors & Products

Vendor	Product	Version / Range
Apache	Software	Foundation Apache DataSketches 1.0.0-incubating

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This is a heap buffer overflow vulnerability in Apache DataSketches C++ affecting HLL sketch deserialization. When processing sketches in LIST mode from untrusted sources, the system reads a coupon count from input and copies it into a fixed 8-entry buffer without checking size limits. A crafted sketch could write up to 988 extra bytes past the buffer, corrupting heap memory and potentially causing crashes or further exploits.

Detection Guidance

To detect this vulnerability, check the version of Apache DataSketches C++ in use. If your version is between 1.0.0-incubating and 5.2.0, the system is vulnerable. Run: 'find / -name "datasketches-cpp*" 2>/dev/null' to locate the library. Then verify the version with commands like 'strings <library_path> | grep -i version' or check package managers (e.g., 'dpkg -l | grep datasketches' on Debian).

If you are deserializing HLL sketches from untrusted sources, monitor for crashes or memory corruption errors during sketch processing. Enable application logs to track deserialization operations and inspect for unusual input sizes.

Impact Analysis

If your application deserializes HLL sketches from untrusted sources using affected versions (1.0.0-incubating to 5.2.0), this flaw could crash your program or allow attackers to execute arbitrary code. Systems processing untrusted sketch data are at risk; those handling only trusted sources remain unaffected.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a technical memory corruption issue in Apache DataSketches C++ that could lead to crashes or potential further exploitation if untrusted sketch data is deserialized. Compliance impacts would depend on how the affected software is used in a system handling regulated data.

Mitigation Strategies

Upgrade Apache DataSketches C++ to version 5.3.0 or later to fix the heap buffer overflow in HLL sketch deserialization. Only applications deserializing HLL sketches from untrusted sources are affected.

Hi! I’m here to help you understand CVE-2026-103501. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70