CVE-2026-103513

Status: Undergoing AnalysisCritical (9.8)—

Severity9.8Critical · CVSS 3.1

Exploitation probability0.39 %higher than 32% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).

A crafted serialized CPC sketch passed to cpc_sketch::deserialize(), from either a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data, because the read position was only checked after decoding finished. In the hybrid flavor, it can also cause a write outside an internal heap buffer, because decoded row indices were not validated. Several other header fields and decoded values, including lg_k, were also not validated. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.

Read full descriptionShow less

This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize CPC sketches from untrusted sources are affected.

Users are recommended to upgrade to version 5.3.0, which fixes this issue.

CVSS

Base score: 9.8
Version: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.39 %
Percentile among all scored CVEs: 32
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access95 %
Primary impactT1499 Endpoint Denial of Serviceimpact85 %
Secondary impactT1059 Command and Scripting Interpreterexecution20 %

Vector AV:N/PR:N/UI:N; deserialización de sketch CPC manipulado causa lectura/escritura fuera de límites y corrupción de heap que provoca caída; la ejecución de código solo es posible 'potencialmente'.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account Management Filter Network Traffic Vulnerability Scanning Restrict Web-Based Content Network Segmentation Limit Software Installation

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Apache — Datasketches CPP^AI

CWEs

CWE-125, CWE-787

References

Show 3 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-103513",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-103513",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-16T15:24:46.482693Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache DataSketches",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0-incubating",
              "versionType": "semver",
              "lessThanOrEqual": "5.2.0"
            }
          ],
          "packageURL": "pkg:github/apache/datasketches-cpp",
          "packageName": "apache/datasketches-cpp",
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-10T11:17:35.853",
  "references": [
    {
      "url": "https://github.com/apache/datasketches-cpp/releases/tag/5.3.0",
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread/s7wyoqyf120dl5ys8jtr26dskd6m485h",
      "source": "security@apache.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/10/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@apache.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).\n\nA crafted serialized CPC sketch passed to cpc_sketch::deserialize(), from either a byte buffer or a stream, can cause the decompressor to read past the end of the compressed data, because the read position was only checked after decoding finished. In the hybrid flavor, it can also cause a write outside an internal heap buffer, because decoded row indices were not validated. Several other header fields and decoded values, including lg_k, were also not validated. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.\n\nThis issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize CPC sketches from untrusted sources are affected.\n\nUsers are recommended to upgrade to version 5.3.0, which fixes this issue."
    }
  ],
  "lastModified": "2026-10-16T16:16:53.457",
  "sourceIdentifier": "security@apache.org"
}