CVE-2026-49206: rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access
rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted sizet indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above INTMAX could wrap to a negative iterator offset and point before the start of the vector, causing undefined behavior, heap memory corruption, or a crash. Triggering the issue requires an extremely large in-memory document, requiring tens of gigabytes of memory at minimum, so typical CSV documents are not practically affected. This issue is fixed in version 8.99.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rapidcsvto a version that resolves this vulnerability.Fixed in 8.99
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
The issue is relevant on 64-bit systems only when rapidcsv processes an in-memory CSV matrix with more than 2^31 elements. Constructing such a document requires at least tens of gigabytes of memory, so typical CSV workloads are not practically affected.
What is required to trigger the flaw?
An operation using RemoveColumn, InsertColumn, RemoveRow, InsertRow, or GetColumnNames must use an index above INT_MAX against an extremely large matrix. The size_t-to-int conversion can then wrap the iterator offset to a negative value.
What can happen if it is triggered?
The wrapped offset can point before the beginning of the vector, resulting in undefined behavior. Reported outcomes include heap memory corruption or a crash.
What remediation is available?
Upgrade rapidcsv to version 8.99, which fixes the issue.