CVE-2026-49206

Deferred Deferred - Pending Action

rapidcsv Library Integer Overflow in Column/Row Operations

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above INT_MAX could wrap to a negative iterator offset and point before the start of the vector, causing undefined behavior, heap memory corruption, or a crash. Triggering the issue requires an extremely large in-memory document, requiring tens of gigabytes of memory at minimum, so typical CSV documents are not practically affected. This issue is fixed in version 8.99.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-49206

EUVD

EUVD-2026-101286

Affected Vendors & Products

Vendor	Product	Version / Range
d99kris	rapidcsv	< 8.99

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow issue in the rapidcsv C++ CSV parser library affecting versions 8.98 and earlier. It occurs when size_t indexes are converted to int before being used in vector iterator arithmetic. On 64-bit systems, indexes above INT_MAX wrap to negative values, causing out-of-bounds access, heap corruption, or crashes. The issue requires a CSV document with over 2^31 elements in a single dimension, which is impractical for typical use.

Detection Guidance

This vulnerability requires a CSV document with over 2^31 elements in a single dimension, which is impractical for typical use cases. Detection would involve checking the rapidcsv library version in use. If using version 8.98 or earlier, the system is vulnerable.

Impact Analysis

This vulnerability could cause undefined behavior, heap memory corruption, or program crashes if exploited. However, triggering it requires an extremely large CSV document with tens of gigabytes of memory, making it unlikely for typical users. The primary impact is reduced availability due to potential crashes.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA. The issue involves potential memory corruption or crashes in rare cases with extremely large CSV files, which are impractical for typical use. No evidence suggests data exposure or unauthorized access risks that would violate these regulations.

Mitigation Strategies

Upgrade the rapidcsv library to version 8.99 or later. If upgrading is not possible, manually apply the patch by changing static_cast<int> to static_cast<std::ptrdiff_t> in the src/rapidcsv.h file.

Hi! I’m here to help you understand CVE-2026-49206. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70