CVE-2026-103636

Executive Summary

CVE-2026-103636 is an out-of-bounds read vulnerability (CWE-125) in the VarOpt union deserialization routine of Apache DataSketches C++ (var_opt_union::deserialize()). The flaw affects versions from 2.0.0-incubating before 5.3.0 and is only exploitable by applications that deserialize VarOpt unions from untrusted sources. Impact includes denial of service (crash) and potential disclosure of adjacent memory contents; a CVSS score is not yet assigned (N/A).

Technical Analysis

Apache DataSketches C++ is a library of approximate streaming algorithms; a "union" object merges multiple sketches. The var_opt_union::deserialize() routine parses a serialized union from a byte buffer. According to the NVD description, the function read the 32-byte preamble of a non-empty union after validating that only 8 bytes were available. Consequently, a truncated serialized union could cause a read of up to 24 bytes past the end of the input buffer.

The defect has two reinforcing components:

1. Length-check mismatch (OOB read): The pre-read validation (8 bytes) was insufficient for the actual preamble access (32 bytes), producing up to a 24-byte over-read.
2. Unsigned integer wraparound: After the preamble, the size remaining for the embedded sketch was computed via an unsigned subtraction that could wrap around. When the computed "remaining" size wrapped to a large value, the embedded sketch's own internal size checks no longer constrained reads to the bounds of the input buffer.

The bytes read during this over-read can become part of the deserialized union's state. This is significant because it elevates a simple crash into a potential information-disclosure primitive: if attacker-supplied state can later be serialized or exposed by the application, adjacent memory contents could leak. This is consistent with the CNA's statement that the issue "could expose adjacent memory contents."

Attack surface / preconditions: The vulnerable code path is reachable only through deserialization of untrusted, truncated VarOpt union payloads. Applications that never deserialize VarOpt unions from untrusted sources are not affected. There is no authentication bypass, no write primitive, and no remote code execution implied by the description.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available. The following chain is inferred strictly from the vulnerability class (OOB read via insufficient length validation) and the NVD description. No function names beyond those in the description (var_opt_union::deserialize()) are asserted.

1. Reconnaissance / target identification: An adversary identifies an application or service that accepts serialized VarOpt union data from an untrusted channel (e.g., a network endpoint, message queue, file upload, or inter-process input path that deserializes union payloads). Version fingerprinting (pre-5.3.0) narrows the target set.

2. Triggering the flaw class: The attacker supplies a deliberately truncated serialized union. Because the code validates only 8 bytes before reading the 32-byte preamble, a payload that ends before the preamble completes triggers an out-of-bounds read of up to 24 bytes. A crafted short embedded-sketch size field can additionally cause the unsigned "remaining size" subtraction to wrap, defeating the embedded sketch's bound checks and allowing further over-reads.

3. Payload/execution method (class level): The payload is simply malformed/truncated serialized union input — no code execution is involved. Exploitation depends on the target application's data-ingestion path accepting the crafted bytes.

4. Post-exploitation impact: Successful triggering causes an out-of-bounds read leading to a crash (denial of service). Because read bytes can enter the deserialized state, an attacker may leverage application behavior that reflects or serializes that state to disclose adjacent memory contents. Without further primitives, code execution is not expected.

Impact Assessment

• Confidentiality (limited): Potential exposure of adjacent memory contents if the over-read bytes surface in deserialized state and are observable to the attacker.
• Integrity: No integrity impact described for this class.
• Availability (limited): Truncated inputs can crash the process (denial of service).
• Scope: Unchanged; no privilege or cross-boundary escalation described.
• Blast radius: Limited to applications that deserialize VarOpt unions from untrusted sources. Library consumers processing only trusted or locally generated data are unaffected.
• CVSS: Not provided by the source data (NVD score N/A). The vector is presented as an inferred placeholder only; do not cite a numeric score.
• EPSS: Not yet scored by FIRST.org — no value fabricated.
• KEV: Not listed in CISA KEV. No known in-the-wild exploitation evidence.

Detection Guidance

Detection focuses on (a) ingesting/validating untrusted serialized union payloads and (b) crashing or anomalous process behavior in services that deserialize sketches. The rules below are heuristic: they target deserialization endpoints and OOB-read crash patterns around DataSketches/union handling.

Sigma Rule

title: Possible DataSketches VarOpt Union Deserialization Abuse (CVE-2026-103636)
id: 3b8f1c2a-7d4e-4a91-9c6b-1f2e0a5d7c10
status: experimental
description: Detects application crashes or deserialization errors consistent with truncated VarOpt union inputs (OOB read) in Apache DataSketches C++.
logsource:
  category: application
  product: datasketches
detection:
  selection_crash:
    EventID|contains:
      - 'SIGSEGV'
      - 'SIGABRT'
      - 'Segmentation fault'
  selection_context:
    Message|contains:
      - 'var_opt_union'
      - 'deserialize'
      - 'datasketches'
      - 'sketch'
  condition: selection_crash and selection_context
falsepositives:
  - Unrelated memory faults in non-sketch code paths
level: medium
tags:
  - attack.t1190
  - cwe.cwe-125

YARA Rule

rule CVE_2026_103636_DataSketches_VarOpt_Union
{
    meta:
        description = "Detects references to Apache DataSketches VarOpt union deserialization paths (CVE-2026-103636)"
        author = "valtersit.com"
        reference = "CVE-2026-103636"
        cwe = "CWE-125"
        severity = "medium"
    strings:
        $ds1 = "var_opt_union" ascii
        $ds2 = "datasketches" ascii nocase
        $ds3 = "deserialize" ascii
        $ds4 = "VarOpt" ascii
    condition:
        filesize < 5MB and (any of ($ds1)) and ($ds3 or $ds2 or $ds4)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-103636 Apache DataSketches VarOpt Union Deserialization Attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"VarOpt"; nocase; content:"|00|"; within:64; classtype:attempted-dos; reference:cve,2026-103636; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-103636; sid:2026103636; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name != null and process.thread.name : "var_opt_union*"]
  [process where event.action == "crash" or process.exit_code == 139 or process.exit_code == 134]

Splunk SPL Query

index=app_logs (Message="*var_opt_union*" OR Message="*datasketches*" OR Message="*deserialize*")
| eval crash=if(match(Message,"(?i)(SIGSEGV|SIGABRT|Segmentation fault|out-of-bounds|heap-buffer-overflow)"),1,0)
| where crash=1
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, Message
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="datasketches,cve-2026-103636,">
  <rule id="100636" level="7">
    <decoded_as>syslog</decoded_as>
    <match>var_opt_union|datasketches|VarOpt</match>
    <regex>(?i)(deserialize|out-of-bounds|heap-buffer-overflow|SIGSEGV|SIGABRT)</regex>
    <description>CVE-2026-103636: Possible Apache DataSketches VarOpt union deserialization OOB read / crash</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Eliminate or tightly restrict deserialization of VarOpt unions from untrusted sources; enforce authentication/authorization and strict input-size and schema validation before parsing.
• Deploy the library in isolated worker processes (sandboxing, seccomp/ASLR, memory guard pages) so an OOB read triggers a contained crash rather than data exposure.
• Truncate/reject payloads that fail strict length checks upstream of the library, and monitor for repeated malformed-union inputs.
• Apply process-level resource limits and crash-loop backoff to reduce DoS impact.

2. Patch / upgrade steps

• The CNA states the issue is fixed in 5.3.0: upgrade Apache DataSketches C++ to 5.3.0 or later.
• Because patch confidence is low (no tracked patch source), independently verify the fix in a controlled build/test environment (ASan/fuzzing) before relying on it, and pin/vendor a reviewed version.
• Rebuild and redeploy all dependent applications, then validate that truncated-union inputs no longer cause OOB reads.

3. Long-term hardening

• Add fuzzing (libFuzzer/AFL) for all deserialization entry points and run CI with AddressSanitizer.
• Replace unsigned size subtractions with checked arithmetic to prevent wraparound.
• Enforce a policy that serialized untrusted data is only parsed by fully hardened, size-validated parsers.
• Track upstream DataSketches releases and subscribe to Apache security advisories for regression coverage.

References

• NVD — CVE-2026-103636: https://nvd.nist.gov/vuln/detail/CVE-2026-103636
• Apache DataSketches: https://datasketches.apache.org/
• CWE-125 (Out-of-bounds Read): https://cwe.mitre.org/data/definitions/125.html
• FIRST EPSS (no score yet for this CVE): https://www.first.org/epss/
• CISA KEV catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat-actor campaigns, public PoC, or exploit-in-the-wild evidence are known for CVE-2026-103636 at this time.