{"id":"CVE-2026-103501","summary":"Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch","details":"Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).\n\nWhen deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of entries to copy into a fixed buffer of 8 entries, without checking it against the buffer's capacity. A crafted sketch could cause a write of up to 988 bytes past the end of this internal heap buffer. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.\n\nThis issue affects Apache DataSketches C++: from 1.0.0-incubating before 5.3.0. Only applications that deserialize HLL sketches from untrusted sources are affected.\n\nUsers are recommended to upgrade to version 5.3.0, which fixes this issue.","modified":"2026-10-15T02:30:43.699605879Z","published":"2026-10-10T10:22:55.843Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-122","CWE-1284"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103501.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/10/10/2"},{"type":"WEB","url":"https://github.com"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103501.json"},{"type":"ADVISORY","url":"https://github.com/apache/datasketches-cpp/releases/tag/5.3.0"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/n2oc2j841dzsv4239jjp08of66bo79c5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103501"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/datasketches-cpp","events":[{"introduced":"fa481e2c0b8dd2e3d6a389338168b930e3e6698d"},{"fixed":"5b5524f55d121225a7909c2851271327684585d7"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0-incubating"},{"last_affected":"5.2.0"},{"fixed":"5.3.0"}],"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103501.json"}}],"schema_version":"1.9.0"}