Apache DataSketches C++ CVE-2026-103635

The host application must call compact_theta_sketch::deserialize() or wrapped_compact_theta_sketch::wrap() (including the stream-based deserialization path) on Theta sketch data originating from an untrusted source - this is the explicit gating condition stated in the advisory and is NOT a default or common deployment pattern. The most severe over-read is reachable via the COMPRESSED compact Theta format, where a 32-bit integer overflow defeats the length check and two unvalidated header fields control decoding. Limiting factors: applications that only deserialize sketches from trusted/internal sources are unaffected; impact is bounded to a crash and disclosure of memory adjacent to the input buffer (no integrity impact); and affected versions are 3.1.0 through 5.2.0 of the C++ library only.

Signals conflict and point to a LOWER real-world priority than the raw 9.1 CVSS suggests. The input CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/A:H) yields Critical, but the Apache release notes explicitly rate CVE-2026-103635 as 'low' severity - the sharpest discrepancy in the data. The vulnerability is purely an out-of-bounds READ (CWE-125), so the I:N in the vector is consistent, but C:H and A:H appear overstated: the description characterizes the impact as a crash (DoS) and possible exposure of ADJACENT memory, which is typically limited disclosure rather than full confidentiality loss. EPSS corroborates the low-priority read: 0.20% probability at the 9th percentile, indicating very low likelihood of near-term exploitation. The CVE is NOT in CISA KEV and no public exploit code was identified, so exploitation status is 'no public exploit identified at time of analysis.' Crucially, exploitation is gated on a non-default application behavior - the host application must deserialize Theta sketches from untrusted sources - which most deployments do not do. Net assessment: this is a high-CVSS-but-low-real-risk issue for the majority of users; it becomes a genuine concern only for the narrow set of applications that ingest attacker-controlled sketch images. The 9.1 should be treated with skepticism and the vendor's 'low' rating as the more credible impact signal.

An application embeds datasketches-cpp and accepts serialized Theta sketch blobs from untrusted clients (e.g., over an API or message queue). An attacker submits a crafted or truncated compact/compressed Theta sketch whose header length fields are manipulated - including a 32-bit integer overflow that defeats the size check - causing the deserializer to read past the end of the buffer, crashing the process or incorporating adjacent heap memory into the resulting sketch. No public exploit code is known; exploitation requires the victim application to deserialize sketches from untrusted input.