Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ allow an attacker to corrupt heap memory. The flaw arises because the decompression bounds are only checked after decoding, and decoded row indices and other header fields such as lg_k are not validated. A crafted serialized CPC sketch supplied to cpc_sketch::deserialize() can therefore read past the end of the compressed data and write outside an internal heap buffer, causing a crash or potentially elevating privileges in a running process.

Apache DataSketches C++ versions 2.0.0‑incubating through 5.2.x are affected. Any application that deserializes CPC sketches from untrusted sources will be vulnerable. Upgrading to version 5.3.0, which removes the flaw, mitigates the issue.

The vulnerability is triggered by the supply of a crafted sketch; thus the likely attack vector is remote delivery of malicious data or local injection if an application accepts untrusted input. The flaw is an out‑of‑bounds memory corruption (CWE-125 and CWE-787). The CVSS score of 9.8 underscores a critical severity. However, the EPSS score of 0.00186, below 1%, indicates a very low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog.