Integer overflow in rapidcsv iterators enables out-of-bounds access
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
rapidcsv versions before 8.99 are affected. The library converts size_t indexes to int before adding them to std::vector iterators in functions such as RemoveColumn, which causes an integer overflow (CWE-190). On 64-bit systems with more than 2^31 matrix elements, a wrapped offset can point before the start of the vector, causing undefined behavior, heap memory corruption or a crash. Triggering it requires a document needing tens of gigabytes of memory, so typical CSV documents are not practically affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above INT_MAX could wrap to a negative iterator offset and point before the start of the vector, causing undefined behavior, heap memory corruption, or a crash. Triggering the issue requires an extremely large in-memory document, requiring tens of gigabytes of memory at minimum, so typical CSV documents are not practically affected. This issue is fixed in version 8.99.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update rapidcsv to version 8.99.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA rapidcsv (d99kris) Fixed in 8.99
Timeline
- 2026-10-14 Threatist record created from CVE-2026-49206
- 2026-10-16 CISA SSVC decision points changed
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences