An out‑of‑bounds read occurs when Apache DataSketches C++ deserializes a compact Theta sketch. The deserialization routine reads header fields without first ensuring that the input buffer is sufficiently long, and when the format is compressed a 32‑bit integer overflow can bypass the size check. In addition two header fields that control decoding are not validated. If a malicious or truncated sketch is deserialized, the read can exceed the input bounds and may acquire data from adjacent memory. The resulting over‑read can crash the process (denial of service) and could expose contents of memory that belong to other parts of the application.

Apache DataSketches C++ is affected from version 3.1.0 through 5.2.x. Any application that deserializes Theta sketches from untrusted or remote sources running those versions is vulnerable.

The CVSS score is 9.1, indicating a high risk level; the EPSS score remains low (<1%), so the overall likelihood of exploitation in the wild is limited. The vulnerability is not listed in CISA’s KEV catalog. A likely attack scenario involves an attacker crafting a malformed compact Theta sketch and sending it to a system that performs deserialization. If the system accepts the sketch from an external or untrusted channel, the vulnerability can be triggered to cause a crash and, in some cases, read adjacent memory. This affects availability and could expose sensitive data if the memory contents are significant. Appropriate mitigation is required to prevent attackers from providing such input.