CVE-2026-103636
Last modified
CVE-2026-103636 is a vulnerability of currently unknown severity. Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. For such inputs, the size remaining for the embedded sketch was also computed by an unsigned subtraction that could wrap around, so the embedded sketch's own size checks no longer limited reads to the input.
Description
Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. For such inputs, the size remaining for the embedded sketch was also computed by an unsigned subtraction that could wrap around, so the embedded sketch's own size checks no longer limited reads to the input. The bytes read can become part of the deserialized union's state. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize VarOpt unions from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache DataSketches | >= 2.0.0-incubating, <= 5.2.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-103636?
How severe is CVE-2026-103636?
How do I fix CVE-2026-103636?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-103627Information leak in SVG in Google Chrome prior to 154.0.8037…6.5
- CVE-2026-103628Out of bounds write in WebGL in Google Chrome prior to 154.0…9.6
- CVE-2026-103629Integer overflow in Skia in Google Chrome prior to 154.0.803…4.3
- CVE-2026-103630Use after free in FedCM in Google Chrome prior to 154.0.8037…9.6
- CVE-2026-103631Buffer overflow in WebRTC in Google Chrome prior to 154.0.80…8.8
- CVE-2026-103635Out-of-bounds read in the compact Theta sketch deserializati…
- CVE-2026-103641A flaw was found in GEGL. The Radiance HDR loader reads past…5.5
- CVE-2026-103646The Ultimate Multisite WordPress plugin before 2.17.0 does …9.8
- CVE-2026-103647Cross-site scripting in the webmail of Progressive Robot hMa…8
- CVE-2026-103648Path traversal in image-downloader 4.3.0 allows an attacker …9.1
- CVE-2026-103649Missing network timeouts in the Linux builds of Progressive …7.5
- CVE-2026-103651MISP contains a vulnerability in its one-time password (OTP)…7.6
Are you affected by CVE-2026-103636?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST