The vulnerability is a heap buffer overflow that occurs when deserializing HyperLogLog (HLL) sketches in LIST mode. A crafted sketch provides a coupon count that is used as the number of entries to copy into a fixed internal heap buffer of eight entries without bounds checking. This oversight allows a write of up to 988 bytes beyond the buffer’s end, corrupting heap memory and causing application crashes. The corruption may also enable further exploitation if an attacker can control subsequent heap allocations. The weakness is identified as CWE-122 and CWE-1284.

Apache Software Foundation’s Apache DataSketches C++ library is affected. Versions from the initial 1.0.0-incubating release up to, but not including, 5.3.0 are vulnerable. Applications that deserialize HLL sketches from untrusted sources—including data received over a network, file imports or third‑party libraries—are the ones impacted.

The CVSS score of 9.8 indicates an extreme severity, reflecting the high risk posed by the heap buffer overflow. With an EPSS score of less than 1%, the current exploitation probability is low, and the vulnerability is not catalogued in the CISA KEV list. The likely attack vector remains the deserialization of maliciously crafted HLL sketches from untrusted sources, such as over a network or from file imports. Exploitation could cause application crashes, heap corruption and, depending on the environment, may allow controlled code execution or further exploitation of subsequent allocations.