A flaw in the VarOpt union deserialization routine of Apache DataSketches C++ reads beyond the end of a truncated input, allowing an attacker to trigger a crash and potentially expose adjacent memory. The bug involves an incorrect buffer size check and an unsigned subtraction that can wrap, both of which fall under CWE‑125 and CWE‑191.

The vulnerability is present in Apache DataSketches C++ versions from 2.0.0‑incubating up to, but not including, 5.3.0. Applications that deserialize VarOpt unions from untrusted sources are affected and should upgrade to version 5.3.0 or later.

The vulnerability can be exploited by supplying a truncated or otherwise malformed VarOpt union to a process that performs unchecked deserialization. EPSS score of <1% suggests a low likelihood of exploitation, and the CVSS score of 7.5 indicates a high severity. The denial‑of‑service impact and potential memory disclosure are the primary concerns. The likely attack vector is any interface that accepts external data for VarOpt union deserialization, such as network input, files, or inter‑process communication.