Apache DataSketches C++ EUVD-2026-96307

Exploitation requires that the target application calls cpc_sketch::deserialize() (from a byte buffer or stream) on CPC sketch data originating from an untrusted source - this is the explicit prerequisite stated in the advisory. The out-of-bounds WRITE additionally requires the sketch to use the 'hybrid' flavor, where decoded row indices were not validated; the out-of-bounds READ arises because the read position was only checked after decoding finished, and additional header fields and decoded values (including lg_k) were unvalidated. LIMITING FACTORS: applications that never deserialize CPC sketches, or only deserialize sketches from trusted/internal sources, are not affected regardless of CVSS score; the vulnerability lives in a C++ library, so reachability depends entirely on whether the embedding application exposes deserialization to attacker-controlled bytes. Fixed in 5.3.0.

Signals conflict and should be weighed carefully. The NVD CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) paints a critical, remotely-exploitable picture, but Apache's own release notes classify this issue as 'moderate' - a notable severity disagreement that defenders should reconcile before treating it as a 9.8. EPSS is low (0.19%, 8th percentile), there is no CISA KEV listing, and no public exploit is referenced, so there is no evidence of active or imminent mass exploitation. Critically, the network attack vector is conditional: the advisory explicitly states that only applications which deserialize CPC sketches from UNTRUSTED sources are affected, so AV:N only holds where an application exposes cpc_sketch::deserialize() to attacker-controlled bytes (e.g., an RPC/API surface). The confirmed technical impact per the description is heap corruption leading to a crash (availability), with code execution described only as 'potentially enabling further exploitation' - so the I:H/C:H portions of the CVSS are plausible (CWE-787 out-of-bounds write) but not demonstrated. Net: this is a real hardening priority for the narrow set of services that ingest untrusted sketch images, but for most deployments it is a high-CVSS-but-conditional DoS risk rather than a widely-weaponizable RCE.

An application or service that accepts serialized Apache DataSketches CPC sketches from external/untrusted input (e.g., a data-analytics API or message consumer) calls cpc_sketch::deserialize() on attacker-supplied bytes. The attacker submits a crafted CPC sketch (hybrid flavor for the write primitive) that causes the decompressor to read past the end of the compressed data and write outside an internal heap buffer, corrupting heap memory to crash the process and potentially enabling further exploitation. No public proof-of-concept is identified at time of analysis.