---
cve: "CVE-2026-103634"
severity: "MEDIUM"
cvss: 5.3
epss: "0.5%"
vendor: "Apache Software Foundation"
kev: false
exploited: false
published: "2026-10-22 07:16:40"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T15:44:22+01:00"
---

# CVE-2026-103634

> 5.3 MEDIUM · 🧪 PoC

## Beschreibung

Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp).

count_min_sketch::deserialize() did not include the preamble in its input size check, so a truncated sketch could cause a read of up to 16 bytes past the end of the input. In addition, the table size was computed from the serialized number of buckets and number of hash functions in 32-bit arithmetic. A crafted sketch could make it wrap to zero, so that the sketch deserialized with an empty table, and later updates and estimate queries read and wrote outside the heap allocation. This can corrupt heap memory, causing a crash and potentially enabling further exploitation.

This issue affects Apache DataSketches C++: from 4.1.0 before 5.3.0. Only applications that deserialize Count-Min sketches from untrusted sources are affected.

Users are recommended to upgrade to version 5.3.0, which fixes this issue.

## CNA-Record (Kanon, cvelistV5)

- CNA: **apache**
- State: PUBLISHED
- Stand: 2026-10-26 13:43:13

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Keine | good |
| A Verfügbarkeit | Gering | warn |

## Schwachstellen-Klasse

- **CWE-190** — Integer Overflow or Wraparound
  The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
- **CWE-787** — Out-of-bounds Write
  The product writes data past the end, or before the beginning, of the intended buffer.

## Angriffsmuster (CAPEC)

- [CAPEC-92 — Forced Integer Overflow](https://capec.mitre.org/data/definitions/92.html) _(Severity: High)_

## Patch verfügbar (OSV)

- 5b5524f55d121225a7909c2851271327684585d7 (Commit)

## Referenzen

- <https://lists.apache.org/thread/rkx9oh06g5cjc6vmmpqloxwfz0gzz01h>
- <https://github.com/apache/datasketches-cpp/releases/tag/5.3.0>
- <http://www.openwall.com/lists/oss-security/2026/10/10/4>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-103634/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_