Is CVE-2026-103513 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103513 being exploited in the wild.

How severe is CVE-2026-103513?

Informational severity, published 10 October 2026.

Which products and versions are affected?

Apache DataSketches C++ 2.0.0-incubating through 5.2.0.

Is there a fix for CVE-2026-103513?

Yes: fixed in 5.3.0. Until then: Do not deserialize CPC sketches from untrusted or unvalidated sources until upgrading to version 5.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103513 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103513?

Check whether you run Apache DataSketches C++ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103513: Apache DataSketches C++ out-of-bounds read/write in CPC deserialization

CVE-2026-103513 · Severity: info · Published 2026-10-10

Apache DataSketches C++ is a library for efficient data sketching and cardinality estimation used in analytics applications. A crafted serialized CPC sketch can cause out-of-bounds memory reads and writes during deserialization, potentially crashing the application or enabling further exploitation. This vulnerability only affects applications that deserialize sketches from untrusted sources.

Technologies: Apache DataSketches C++. Vendors: Apache.

Quick answers

Is CVE-2026-103513 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103513 being exploited in the wild.
How severe is CVE-2026-103513?: Informational severity, published 10 October 2026.
Which products and versions are affected?: Apache DataSketches C++ 2.0.0-incubating through 5.2.0.
Is there a fix for CVE-2026-103513?: Yes: fixed in 5.3.0. Until then: Do not deserialize CPC sketches from untrusted or unvalidated sources until upgrading to version 5.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103513 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103513?: Check whether you run Apache DataSketches C++ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 5.3.0

Do not deserialize CPC sketches from untrusted or unvalidated sources until upgrading to version 5.3.0.

Technical details

The CPC sketch deserialization in cpc_sketch::deserialize() fails to validate the read position until after decompression completes, allowing reads past the end of compressed data. In hybrid mode, decoded row indices are not validated before writing to an internal heap buffer. Additionally, header fields like lg_k and other decoded values lack validation. An attacker can supply a malformed CPC sketch via byte buffer or stream to trigger heap corruption.

Affected products

Apache DataSketches C++ 2.0.0-incubating through 5.2.0

Timeline

2026-10-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.