CVE-2026-103501

Summary

A heap buffer overflow occurs when deserializing HLL sketches in LIST mode from untrusted sources, allowing attackers to write up to 988 bytes past a fixed 8-entry buffer boundary. This can corrupt heap memory and potentially enable further exploitation.

Exploitability

Exploitation is moderately difficult as it requires crafting a malicious sketch file that triggers the deserialization process, but the vulnerability is remotely exploitable since applications deserialize untrusted data from external sources.

Blast radius

The impact could be significant across systems processing HLL sketches from external sources, potentially affecting analytics pipelines, data processing workflows, and any application using Apache DataSketches C++ for sketch deserialization.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 5.3.0 which fixes this heap buffer overflow vulnerability in the HLL sketch deserialization.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.