CVE-2026-49206 in rapidcsv
Summary
by MITRE • 10/14/2026
rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above INT_MAX could wrap to a negative iterator offset and point before the start of the vector, causing undefined behavior, heap memory corruption, or a crash. Triggering the issue requires an extremely large in-memory document, requiring tens of gigabytes of memory at minimum, so typical CSV documents are not practically affected. This issue is fixed in version 8.99.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The rapidcsv library serves as a C++ utility for parsing Comma Separated Values files, providing functionality to manipulate data structures such as rows and columns within an in-memory matrix representation. A critical vulnerability exists in versions prior to 8.99 involving the handling of size_t indexes during column and row manipulation operations. Specifically, functions including RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames perform a conversion from unsigned size_t indices to signed int types before utilizing these values as offsets for std::vector iterators. This type casting introduces a significant integer overflow vulnerability on 64-bit systems where the maximum value of an int is significantly smaller than the maximum value of a size_t.
When processing CSV matrices with dimensions exceeding two billion three hundred forty million eight hundred sixteen elements, which corresponds to INT_MAX, any index larger than this threshold will wrap around due to signed integer overflow rules in C++. This wrapping results in negative iterator offsets that point before the beginning of the vector container. Accessing memory via such invalid iterators leads to undefined behavior as defined by the C++ standard. In practical execution environments, this typically manifests as heap memory corruption or application crashes because the program attempts to access memory addresses outside the allocated bounds of the vector data structure.
The operational impact of this vulnerability is theoretically severe but practically limited due to resource constraints. Triggering the exploit requires an in-memory document containing more than two billion elements, which necessitates tens of gigabytes of RAM depending on the element size and overhead. Consequently, typical CSV documents used in standard business or scientific applications are not susceptible to exploitation because they rarely approach such massive dimensions. However, for specialized high-performance computing scenarios or systems processing extremely large datasets without adequate memory limits, this flaw could lead to denial of service through application crashes or potential data integrity issues via heap corruption if the undefined behavior is exploited further by an attacker controlling input parameters in a privileged context.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write when considering the resulting memory access violations. It also relates to improper handling of large data structures which can be mapped to ATT&CK techniques involving resource exhaustion if used for denial of service purposes. The root cause lies in the unsafe assumption that index values will always fit within a signed integer range, ignoring the wider address space available on 64-bit architectures.
To mitigate this vulnerability, organizations using rapidcsv must upgrade immediately to version 8.99 or later where these type conversions have been corrected to maintain unsigned arithmetic consistency throughout iterator operations. Developers should also implement input validation checks that verify matrix dimensions against realistic memory constraints before processing large files. Additionally, enabling compiler warnings for implicit narrowing conversions can help identify similar potential issues in custom codebases using the library. Regular security audits focusing on integer handling and bounds checking are recommended to prevent recurrence of such logic errors in data parsing libraries.