Integer Overflow in C++ CSV Parser Library RapidCSV

CVE-2026-49206

What is CVE-2026-49206?

The RapidCSV library, a C++ CSV parser, prior to version 8.99, has an integer overflow vulnerability that occurs when handling large CSV documents with more than 2^31 elements. Due to the conversion of size_t indexes to int, it may lead to negative iterator offsets in std::vector, resulting in undefined behavior or heap memory corruption. This issue primarily affects extremely large in-memory documents, necessitating significant memory usage (tens of gigabytes minimum). Users are advised to upgrade to version 8.99 to mitigate this risk.

References