CVE-2026-123274
Apache DataSketches C++: Out-of-bounds write in KLL sketch deserialization allows memory corruption via a crafted sketch
CVE-2026-123274 is a vulnerability with no CVSS score yet in Apache Software Foundation Datasketches C++, published November 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. No source names a fixed version.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- 0.23%EPSS, 13th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a KLL sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized level boundaries were not validated.
This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
Exploit likelihood
Affected products
What each source reports
CVE ListNo score
Apache DataSketches C++: Out-of-bounds write in KLL sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a KLL sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized level boundaries were not validated.
This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
CVE-2026-123274- Weakness
- CWE-787
- Updated
- 2026-11-13
EUVDEUVD-2026-125275No score
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a KLL sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized level boundaries were not validated.
This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
EUVD-2026-125275- Updated
- 2026-11-13
GitHub AdvisoriesGHSA-v92m-x8fp-25xmNo score
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes...
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a KLL sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized level boundaries were not validated.
This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
GHSA-v92m-x8fp-25xm- Weakness
- CWE-787
- Updated
- 2026-11-13
NVDNo score
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a KLL sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized level boundaries were not validated.
This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
CVE-2026-123274- Weakness
- CWE-787
- Updated
- 2026-11-13
OSVNo score
Apache DataSketches C++: Out-of-bounds write in KLL sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a KLL sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized level boundaries were not validated.
This issue affects Apache DataSketches C++: 2.0.0 through 5.3.0.
Users are recommended to upgrade to version 5.3.1, which fixes the issue.
- Record
CVE-2026-123274- Weakness
- CWE-787
- Updated
- 2026-11-15
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references | CVE List, GitHub Advisories | |
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.apache.org/thread/t4rngyg9cbv1b42f1d0crgpgtpby0594
github.com/apache/datasketches-cpp/releases/tag/5.3.1
openwall.com/lists/oss-security/2026/11/13/1
nvd.nist.gov/vuln/detail/CVE-2026-123274