Out-of-Bounds Read in Apache DataSketches C++ Affects Serialization Process

CVE-2026-103636

What is CVE-2026-103636?

A vulnerability has been identified in the VarOpt union deserialization process within Apache DataSketches C++. An out-of-bounds read occurs due to an improper handling of serialized data, allowing potential access to memory outside the intended range. This is triggered specifically when deserializing VarOpt unions from untrusted sources, which can lead to a crash and potentially expose sensitive memory contents. It's crucial for users to update to version 5.3.0 to mitigate these security risks.

References