CVE-2026-103513

Executive Summary

CVE-2026-103513 is an out-of-bounds read and write vulnerability in the CPC sketch deserialization logic of Apache DataSketches C++, affecting versions from 2.0.0-incubating up to (but not including) 5.3.0. Applications that pass untrusted serialized CPC sketch data to cpc_sketch::deserialize() — from a byte buffer or a stream — are exposed. Successful exploitation can corrupt heap memory, cause a crash, and potentially enable further exploitation such as code execution or information disclosure.

Technical Analysis

Apache DataSketches is a library of stochastic streaming algorithms used for approximate distinct-counting and quantile estimation over large data streams. CPC (Compressed Probabilistic Counting) is one such sketch family. The vulnerability resides in the deserialization path: cpc_sketch::deserialize() accepts a crafted serialized CPC sketch (either from an in-memory byte buffer or a stream) and processes it with insufficient bounds and validation checks.

Two distinct memory-safety defects are described:

1. Out-of-bounds read during decompression (compressed data over-read): The decompressor reads past the end of the compressed data because the read position is only checked after decoding has already finished. In practice this means the loop reads one or more bytes beyond the allocated compressed buffer before any boundary validation occurs, leaking adjacent heap contents into sketch state or simply reading unmapped memory.

2. Out-of-bounds write in the hybrid flavor: The hybrid CPC flavor decodes row indices and writes them into an internal heap buffer without validating that the decoded indices fall within the buffer bounds. A crafted sketch can therefore drive a write outside that internal heap allocation.

Additionally, "several other header fields and decoded values, including lg_k, were also not validated." lg_k is the base-2 logarithm of the sketch's k parameter (nominal number of entries). Because it is used to size/derive internal structures, an unvalidated attacker-controlled lg_k can produce incorrect allocation or indexing arithmetic that compounds the row-index and decompressor over-read problems. The net effect is heap corruption — a crash is the most immediate symptom, with potential for further exploitation (arbitrary read/write, control-flow hijack) depending on allocator behavior and the surrounding application.

Attack surface: Any component that deserializes CPC sketches from an untrusted source. Examples include network services accepting serialized sketches, message queues, RPC endpoints, file upload handlers, or cross-process/cross-tenant sketch exchange. The library provides no inherent authentication or provenance guarantees on serialized input; safety depends entirely on the caller.

CWE classification: CWE-125 (Out-of-bounds Read) is the assigned primary weakness; the hybrid write defect corresponds to CWE-787 (Out-of-bounds Write).

Exploitation Scenarios

No public proof-of-concept or exploit code is available. The attack chain below is inferred strictly from the vulnerability class and the NVD description; it avoids inventing implementation details not present in the source text.

1. Reconnaissance / target identification. The attacker identifies an application that (a) links Apache DataSketches C++ between 2.0.0-incubating and 5.2.x, and (b) deserializes CPC sketches from a source the attacker can influence — for example a serialized sketch received over the network, read from a user-supplied file, or consumed from a compromised queue. Fingerprinting may rely on service banners, error messages, or API behavior consistent with DataSketches-backed endpoints.

2. Triggering the flaw. The attacker crafts a serialized CPC sketch whose header fields (including lg_k) and/or encoded payload are malformed. Delivering this blob to cpc_sketch::deserialize() — via byte buffer or stream — causes the decompressor to read past the end of compressed data (because the read position is validated only after decoding completes). If the hybrid flavor is in use, decoded row indices are written to an internal heap buffer without bounds validation, producing an out-of-bounds write. Unvalidated header fields such as lg_k further perturb internal sizing/indexing.

3. Payload / execution method (vulnerability-class level). The "payload" is the malformed serialized sketch itself; no shellcode or code injection is required to trigger the fault. The attacker tunes the malformed fields to influence how far past the buffer the read advances and where the out-of-bounds write lands, with the goal of corrupting adjacent heap metadata or application-managed objects. Because the described defects are memory-safety issues in native C++ code, successful heap grooming can escalate from a crash to controlled memory corruption.

4. Post-exploitation impact. At minimum, the malformed sketch causes a denial-of-service (crash) of the deserializing process. Where heap corruption can be shaped, the attacker may achieve further exploitation — arbitrary memory read (leaking secrets or pointers from adjacent heap) or memory write leading to control-flow influence — subject to the surrounding allocator, process hardening (ASLR, stack canaries, heap protections), and the exact code path exercised.

No public PoC, Nuclei template, or exploit code is available; the attack chain is inferred from the vulnerability class.

Impact Assessment

• Confidentiality (Low–None → potentially High if heap read is weaponized): the out-of-bounds read can expose adjacent heap memory, potentially leaking sensitive data or memory layout information useful for follow-on exploitation.
• Integrity (Low): the hybrid out-of-bounds write can corrupt heap memory; integrity impact is bounded by the attacker's ability to control the write.
• Availability (High): the most reliable outcome is a process crash due to reading unmapped memory or corrupting heap metadata — a straightforward denial-of-service against any service that deserializes untrusted CPC sketches.
• Scope: unchanged; the vulnerable component and impacted component are the same process.
• Blast radius: limited to applications that deserialize CPC sketches from untrusted sources. Internal-only deployments where serialized sketches are treated as trusted, authenticated data are not exposed.

A CVSS score was not assigned by NVD at the time of writing (N/A). No EPSS score is available. CVE-2026-103513 is not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Potential Apache DataSketches CPC Deserialization Exploitation Attempt
id: 9f2c1e7a-3b64-4d18-9c5a-0d7b1e4f6a22
status: experimental
description: Detects process crashes or abnormal termination events consistent with heap corruption during CPC sketch deserialization in Apache DataSketches C++ (< 5.3.0).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103513
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_crash:
    Image|endswith:
      - '/datasketches'
      - '/cpc_sketch'
  condition: selection_crash
falsepositives:
  - Legitimate test harnesses exercising deserialization edge cases
level: medium

YARA Rule

rule CVE_2026_103513_DataSketches_CPC_Serialized
{
    meta:
        description = "Heuristic detection of CPC sketch serialization magic/headers associated with CVE-2026-103513"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103513"
        date = "2026-01-01"
    strings:
        $magic = { 0x01 0x0A }   // illustrative placeholder; adjust to observed CPC serialization magic
        $lgk   = "lg_k"
    condition:
        $magic at 0 or $lgk
}

Note: The exact serialized CPC byte signature is not disclosed in the advisory. The rule above is a template; operators must tune the magic/offset after capturing known-good and known-malformed sketch artifacts in their environment.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-103513 Apache DataSketches CPC deserialization - malformed sketch over HTTP"; flow:established,to_server; content:"|01 0A|"; depth:32; pcre:"/datasketches|cpc/i"; classtype:attempted-dos; sid:2026103513; rev:1;)

Elastic Detection

process where event.type in ("start", "end") and process.name in ("datasketches", "cpc_sketch", "cpc_deserialize") and process.exit_code != 0

Splunk SPL Query

index=os OR index=app
| search ("cpc_sketch" OR "DataSketches" OR "datasketches")
| where match(_raw, "(?i)deseriali[sz]e")
| stats count by host, process_name, exit_code, _time
| where exit_code!=0 OR exit_code=139 OR exit_code=134

Wazuh OSSEC Rule

<group name="datasketches,">
  <rule id="100513" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">cpc_sketch|datasketches|cpc_deserialize</field>
    <match>deserialize|out-of-bounds|heap corruption|SIGSEGV|SIGABRT</match>
    <description>CVE-2026-103513: Possible Apache DataSketches CPC deserialization heap corruption</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory recommends upgrading to Apache DataSketches C++ 5.3.0; however, no patch commit, vendor advisory URL, or tracked patch source was supplied in the intelligence feed, so this cannot be independently confirmed.

1. Immediate mitigations

   • Ensure CPC sketches are never deserialized from untrusted sources. Enforce authentication and provenance on any channel that carries serialized sketches (message queues, RPC endpoints, file uploads, cross-tenant data exchange).
   • Where untrusted sketches must be handled, isolate the deserialization process (sandbox, seccomp, privilege drop, memory limits) so a crash or heap corruption cannot affect the host or other services.
   • Deploy the detection rules above to surface crashes and abnormal terminations associated with CPC deserialization.

2. Patch / upgrade steps

   • Upgrade Apache DataSketches C++ to 5.3.0, which per the advisory fixes the issue. Validate the fix against your serialization artifacts before production rollout.
   • If 5.3.0 cannot be adopted immediately, treat untrusted-sketch deserialization as a blocking risk and suspend it until the upgrade is applied.

3. Long-term hardening

   • Add defensive input validation and length/bounds checks on all sketch header fields (including lg_k) and decoded indices prior to use.
   • Build and test native dependencies with compiler hardening enabled (ASLR, stack canaries, -D_FORTIFY_SOURCE, hardening allocators) to reduce exploitability of residual memory-safety defects.
   • Maintain an SBOM and dependency tracking for C/C++ libraries so affected versions are quickly identified when advisories land.
   • Fuzz deserialization entry points as part of CI to catch similar bounds-checking regressions earlier.

References

• NVD — CVE-2026-103513: https://nvd.nist.gov/vuln/detail/CVE-2026-103513
• Apache DataSketches (C++) project: https://github.com/apache/datasketches-cpp
• Apache Software Foundation security advisories: https://apache.org/security/
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-103513 at this time; the CVE is not listed in CISA KEV and no public PoC or Nuclei template is available.