The vulnerability stems from an out-of-bounds read and write in the Count‑Min sketch deserialization routine in Apache DataSketches C++. A truncated sketch skips the preamble size check, permitting a read up to 16 bytes past the input boundary. Additionally, the sketch’s table size calculation uses 32‑bit arithmetic, allowing an attacker to craft a sketch that causes the table size to wrap to zero. When the sketch is later updated or queried, the application reads and writes beyond the allocated heap, potentially corrupting memory, crashing the process, and opening the door for remote exploitation. This flaw is an instance of Integer Overflow or Wraparound (CWE‑190) and Out‑of‑Bounds Write (CWE‑787).

Apache DataSketches C++ is affected in all releases from 4.1.0 up through, but not including, 5.3.0. Only applications that deserialize Count‑Min sketches originating from untrusted or partially controlled sources are at risk. The vulnerability does not affect other DataSketches components or earlier versions that do not include the deserialization code.

The flaw allows arbitrary memory corruption, which, in a suitable environment, could lead to arbitrary code execution or denial of service. Although no EPSS score is available, the severity is likely high due to the nature of the heap corruption. The vulnerability is not listed in the CISA KEV catalog, but the potential impact and the absence of mitigations in affected versions mean that exploitation is feasible for an attacker able to supply a crafted sketch. No particular prerequisites beyond the ability to provide deserialized data are required; thus the risk applies to any deployment that accepts sketch data from external input.