Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization
Apache DataSketches C++ is vulnerable to an out-of-bounds write during the deserialization of REQ sketches due to insufficient validation of serialized compactor headers, which can lead to heap memory corruption.
CVE search metadata
CVE search record: CVE-2026-123338. KEV: no. Product: DataSketches C++. Brief: Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization. Brief link: https://feed.craftedsignal.io/briefs/2026-11-apache-datasketches-cpp-oob-write-cve-2026-123338/
Triage facts
Revision 1- Applicability
- DataSketches C++
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Nov 13, 04:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
Apache DataSketches C++ contains an out-of-bounds write vulnerability that can be triggered during the deserialization of a REQ sketch from an untrusted source. This occurs because the library fails to properly validate serialized compactor headers, resulting in potential heap memory corruption.
Impact
An attacker providing a crafted sketch can cause heap memory corruption when the application deserializes the data.
Recommendation
Users are advised to monitor the Apache DataSketches C++ project for updates addressing this issue.