{"uuid": "a54e2014-dbeb-427e-a538-bc2758d1ca6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-103501", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117416163574564113", "content": "CVE-2026-103501 Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).\nWhen deserializing a sketch in LIST mode, from either a byte buffer or a stream, the coupon count was read from the input and used as the number of entries to copy into a fixed buffer of 8 entries, without checking it against the buffer's capacity. A crafted sketch could cause a write of up to 988 bytes past the end of this internal heap buffer. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.\nThis issue affects Apache DataSketches C++: from 1.0.0-incubating before 5.3.0. Only applications that deserialize HLL sketches from untrusted sources are affected.\nUsers are recommended to upgrade to version 5.3.0, which fixes this issue.\nhttps://www.cve.org/CVERecord?id=CVE-2026-103501https://lists.apache.org/thread/n2oc2j841dzsv4239jjp08of66bo79c5https://github.com/apache/datasketches-cpp/releases/tag/5.3.0#apache #ApacheSoftwareFoundation #ApacheDataSketches#CVE_2026_103501#bot", "creation_timestamp": "2026-10-10T10:34:33.040614Z"}