Advisory CVE-2026-103513, published by Lee Rhodes on October 10, 2026 on the oss-sec feed, describes out-of-bounds read and write in CPC sketch deserialization in Apache DataSketches C++ (repository datasketches-cpp). The stated severity is moderate. Affected versions range from 2.0.0-incubating through 5.2.0.
According to the available text, a serialized CPC sketch crafted for this purpose, passed to cpc_sketch::deserialize() either from a byte buffer or from a stream, can cause the decompressor to read beyond the end of the compressed data. The excerpt indicates that the read position was only partially checked. The summary also mentions memory corruption. The text received is a machine translation and is truncated, so the full description and the fix should be read in the original.
Relevance: Rota Nacional is not the source of this problem and does not claim to fix it. This is a flaw in a software library. If your organization uses datasketches-cpp, in its own applications or in third-party components, the guidance is to confirm the installed version, compare it with the affected range, and apply the update indicated by the official project.
How to check the original: open the advisory on the oss-sec list, in the 2026 fourth-quarter archive, and confirm the date, severity, affected versions and fix published by the Apache DataSketches project. Machine translation may contain errors.