CVE-2026-49206 Details
Description
rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above INT_MAX could wrap to a negative iterator offset and point before the start of the vector, causing undefined behavior, heap memory corruption, or a crash. Triggering the issue requires an extremely large in-memory document, requiring tens of gigabytes of memory at minimum, so typical CSV documents are not practically affected. This issue is fixed in version 8.99.
A vulnerability in the rapidcsv library, prior to version 8.99, allows for out-of-bounds access due to an integer overflow in iterator arithmetic. This issue arises in several functions, including RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames. The vulnerability is present on 64-bit systems where the CSV matrix dimension exceeds 2^31 elements, causing size_t indexes to wrap around and point before the start of a vector. This can lead to undefined behavior, heap memory corruption, or a crash. Exploiting this vulnerability requires an extremely large in-memory document, typical CSV files are not affected.
Users are advised to upgrade to rapidcsv version 8.99 or later. If an upgrade is not possible, the vulnerability can be manually patched by replacing static_cast with static_cast<std::ptrdiff_t> in the five affected iterator-arithmetic call sites in src/rapidcsv.h.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/d99kris/rapidcsv/commit/68f57cc6c83d5e0992904398822453489d8dfac1 | [email protected] | Source CodeVendor |
| https://github.com/d99kris/rapidcsv/issues/220 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/d99kris/rapidcsv/releases/tag/v8.99 | [email protected] | Release NotesVendor |
| https://github.com/d99kris/rapidcsv/security/advisories/GHSA-v83v-8j5q-6553 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rapidcsv | <= 8.98 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |