EUVD-2026-96309
GHSA-9935-w26g-xf2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit truncated serialized VarOpt union
-
DeliveryPass 8-byte check but read 32-byte preamble
-
ExploitTrigger unsigned size wraparound on embedded sketch
-
ExecutionRead up to 24 bytes past buffer
-
ImpactCrash service or disclose adjacent memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the consuming application call var_opt_union::deserialize() on a serialized VarOpt union image obtained from an untrusted or attacker-controlled source; the library is not exploitable in isolation. The specific trigger is a non-empty but truncated union where only 8 bytes are validated as available before the 32-byte preamble is read, combined with an unsigned subtraction that wraps when computing the embedded sketch's remaining size. Limiting factors: affected versions are 2.0.0-incubating through 5.2.0 (fixed in 5.3.0); applications that never deserialize VarOpt unions, or only from trusted sources, are not affected; no authentication is required at the library level, but the untrusted-deserialization code path must actually be reachable by the attacker. |
| Impact | Signals are mixed and point to a modest real-world priority rather than an urgent one. The NVD CVSS 3.1 base score is 7.5 (HIGH), but that score is driven entirely by Availability (A:H) with C:N/I:N - i.e. NVD models this purely as a denial-of-service crash. EPSS is only 0.24% (14th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced, so exploitation is neither observed nor predicted to be widespread. Notably, the Apache vendor release notes rate this issue 'low', which conflicts with the NVD HIGH rating - this is a severity disagreement worth flagging to defenders. There is also an internal conflict in the impact modeling: the NVD vector sets C:N, yet the description explicitly states the flaw 'could expose adjacent memory contents' and that those bytes 'can become part of the deserialized union's state,' which implies some confidentiality impact the NVD vector omits. No SSVC decision data (exploitation/automatable/technical-impact) was provided in the input, so that framework cannot be applied. Overall: a real but not high-urgency library bug, heavily gated by the precondition that an application deserializes VarOpt unions from untrusted input. |
| Exploit ScenarioDerived | An application built on datasketches-cpp accepts serialized VarOpt union images from an untrusted source (e.g. a network client or uploaded file) and calls var_opt_union::deserialize(). An attacker submits a deliberately truncated union that passes the 8-byte availability check but triggers a read of the 32-byte preamble plus a wrapped-around size for the embedded sketch, crashing the process or surfacing adjacent heap memory into the deserialized state. No public proof-of-concept is referenced; AV:N/AC:L/PR:N/UI:N means that where this code path is exposed, triggering it is trivial and unauthenticated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 16, 2026
Out-of-bounds read in Apache DataSketches C++ (datasketches-cpp) allows an attacker who controls a serialized VarOpt union image to trigger reads of up to 24 bytes past the end of the supplied buffer, causing a crash (denial of service) and potentially leaking adjacent heap memory into the deserialized union's state. Applications are exposed only if they call var_opt_union::deserialize() on data from untrusted sources; affected releases are 2.0.0-incubating through 5.2.0, and the library is not exploitable on its own. No public exploit code has been identified at time of analysis, EPSS is low at 0.24% (14th percentile), and the issue is not listed in CISA KEV, so the practical priority is moderate rather than urgent. The vendor-released fix is version 5.3.0, which also remediates four other deserialization flaws.
Earlier versions of this analysis (1)
Out-of-bounds read in Apache DataSketches C++ VarOpt union deserialization affects library versions 2.0.0-incubating through 5.2.0, allowing unauthenticated remote attackers to read up to 24 bytes past a truncated input buffer, which can crash the application (denial of service) and potentially disclose adjacent memory contents. Exploitation requires the embedding application to deserialize attacker-controlled VarOpt union images from untrusted sources, and the read-only primitive limits real-world impact; no public exploit code has been identified at time of analysis. The independent assessment rates the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L and classifies this as a low-priority issue for the vast majority of environments, with the vendor-released fix in version 5.3.0.
RemediationAI
Upgrade to Apache DataSketches C++ 5.3.0, the exact version that fixes this issue as part of a broader deserialization hardening set (upstream fixes #503, #536 and #538 in the datasketches-cpp repository) that also closes CVE-2026-103501, CVE-2026-103513, CVE-2026-103634 and CVE-2026-103635; see the release notes at https://github.com/apache/datasketches-cpp/releases/tag/5.3.0 and the advisory at https://lists.apache.org/thread/znn94s463w7wy125khcywxsp82y2qkq5. If an immediate upgrade is not possible, the highest-value compensating control is to stop feeding untrusted bytes into var_opt_union::deserialize(): require that serialized unions come from trusted producers, or authenticate and integrity-check sketch images (for example HMAC or signature verification) before deserialization - the trade-off is added key management and a compatibility break for producers that cannot sign. Where untrusted input is unavoidable, length-gate the input before calling deserialize by rejecting any buffer smaller than the maximum plausible non-empty union image (at minimum the 32-byte preamble plus the embedded sketch's declared size) and enforce a strict upper bound on accepted image size; this defeats the truncated-input trigger but does not repair the underlying unsigned-wraparound arithmetic, so it must be paired with the upgrade. Finally, isolate deserialization in a subprocess or sandbox with restricted memory and no access to sensitive heap contents, and compile with hardened allocators or ASan-style bounds checking in non-production test environments; these measures reduce crash blast radius and the chance that over-read bytes reach application state, but they carry performance and operational overhead and should not be treated as a substitute for 5.3.0.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds read (CWE-125) in the C++ implementation of Apache DataSketches' VarOpt union, a mergeable sketch used for weighted sampling and streaming analytics that can be persisted and exchanged as a binary image. The deserializer validates only 8 bytes of available input before reading the 32-byte preamble of a non-empty union, so a deliberately truncated image is parsed 24 bytes past the buffer end. A second defect compounds this: the remaining byte count for the embedded sketch is derived by an unsigned subtraction that can wrap to a huge value, defeating the embedded sketch's own length checks so reads are no longer bounded by the real input. Bytes read past the buffer can be incorporated into the reconstructed union state, which explains why the NVD vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) emphasizes availability impact while our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) also credits low confidentiality impact from adjacent-memory exposure. The CPE cpe:2.3:a:apache_software_foundation:apache_datasketches identifies the affected package family; the vulnerable surface is specifically the C++ library consumed by datasketches-python, datasketches-postgresql and other wrappers that deserialize VarOpt union images. This CVE is one of five deserialization hardening fixes shipped together in 5.3.0 (alongside CVE-2026-103501 in HLL, CVE-2026-103513 in CPC, CVE-2026-103634 in Count-Min, and CVE-2026-103635 in compact Theta), all sharing the same trust-boundary root cause: caller-supplied byte streams treated as trustworthy.
Know when Apache Datasketches gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Crafting a truncated union is trivial (AC:L) and needs no auth at the library (PR:N); A:H for the crash, and C:L because disclosed adjacent memory can enter the union state - unlike NVD's C:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
1DescriptionCVE.org
Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp).
var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. For such inputs, the size remaining for the embedded sketch was also computed by an unsigned subtraction that could wrap around, so the embedded sketch's own size checks no longer limited reads to the input. The bytes read can become part of the deserialized union's state. This can cause a crash (denial of service) and could expose adjacent memory contents.
This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize VarOpt unions from untrusted sources are affected.
Users are recommended to upgrade to version 5.3.0, which fixes this issue.
Executive ViewAI
Apache DataSketches C++ (datasketches-cpp) has a high-severity out-of-bounds read in var_opt_union::deserialize() that can crash services and potentially leak adjacent heap memory when they process untrusted serialized VarOpt union data. Only applications that explicitly deserialize such data from untrusted sources are exposed, and affected releases are 2.0.0-incubating through 5.2.0. No public exploit identified at time of analysis and no CISA KEV activity, so the business risk is moderate but warrants tracked remediation, particularly for internet-facing or multi-tenant services using this code path.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Apache Datasketches
View allHeap buffer overflow in Apache DataSketches C++ (versions 1.0.0-incubating through 5.2.0) allows an unauthenticated remo
Out-of-bounds read and write in the CPC sketch deserialization path of Apache DataSketches C++ (datasketches-cpp) - spec
Out-of-bounds read in Apache DataSketches C++ versions 3.1.0 through 5.2.0 is reachable when an application deserializes
Exploit-DB