CVE-2026-103501: heap buffer overflow in HLL CouponList deserialization in Apache DataSketches

On 10 October 2026, Lee Rhodes published on the oss-sec list an advisory for CVE-2026-103501, rated moderate severity. The issue affects HLL sketch deserialization in Apache DataSketches C++ (repository datasketches-cpp). According to the text available in the feed, when deserializing a sketch in LIST mode, whether from a byte buffer or a stream, the coupon count is read from the input and used as the number of elements to copy into a fixed buffer of 8 entries, without checking whether the value exceeds that limit. The stated result is memory corruption. Affected versions range from 1.0.0-incubating through 5.2.0. The text we received is a machine translation and is truncated in the description, so the full reading should be done in the original English message, whose address is in the source and is not reproduced here. For anyone using the library, the practical recommendation is to check the dependency inventory for affected versions, consult the project's fix notes, and update. Sketches received from untrusted sources should be treated as hostile input until the update is applied.