CVE-2026-49206: CWE-190: Integer Overflow or Wraparound in d99kris rapidcsv
Description
CVE-2026-49206 is an integer overflow or wraparound vulnerability in the rapidcsv C++ CSV parser library prior to version 8.99. The issue occurs because size_t indexes are converted to int before being added to std::vector iterators, which on 64-bit systems with very large CSV matrices (more than 2^31 elements) can cause negative iterator offsets. This leads to undefined behavior, potential heap memory corruption, or crashes. Exploitation requires extremely large in-memory CSV documents, making typical usage scenarios unlikely to be affected. The vulnerability is fixed in version 8.99.
CVSS v3.1
Score 2.9low
Affected software
d99kris
rapidcsv
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The rapidcsv library versions before 8.99 convert size_t indexes to int when manipulating vector iterators for operations like RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames. On 64-bit systems, if a CSV matrix dimension exceeds 2^31 elements, indexes above INT_MAX wrap around to negative values, causing iterators to point before the vector start. This can result in undefined behavior including heap corruption or application crashes. Due to the large memory requirements (tens of gigabytes), typical CSV files do not trigger this issue. The vulnerability is addressed by correcting the index handling in version 8.99.
Potential Impact
The vulnerability can cause application crashes or heap memory corruption when processing extremely large CSV files on 64-bit systems. There is no confidentiality or integrity impact reported. The low CVSS score (2.9) reflects the limited practical exploitability due to the large resource requirements and local attack vector with high complexity.
Mitigation Recommendations
Upgrade to rapidcsv version 8.99 or later where this issue is fixed. No other mitigations are indicated or necessary given the nature of the vulnerability and the fix availability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-28T03:42:34.340Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfa7f62cdf04f65692bb4f
Added to database: 10/14/2026, 16:04:06 UTC
Last enriched: 10/14/2026, 16:18:24 UTC
Last updated: 10/14/2026, 16:18:24 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.