{"id":"CVE-2026-49206","summary":"rapidcsv: Integer overflow in iterator arithmetic causes out-of-bounds access","details":"rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above INT_MAX could wrap to a negative iterator offset and point before the start of the vector, causing undefined behavior, heap memory corruption, or a crash. Triggering the issue requires an extremely large in-memory document, requiring tens of gigabytes of memory at minimum, so typical CSV documents are not practically affected. This issue is fixed in version 8.99.","aliases":["GHSA-v83v-8j5q-6553"],"modified":"2026-10-15T07:08:38.792045866Z","published":"2026-10-14T15:44:43.286Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-190","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49206.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49206.json"},{"type":"FIX","url":"https://github.com/d99kris/rapidcsv/commit/68f57cc6c83d5e0992904398822453489d8dfac1"},{"type":"REPORT","url":"https://github.com/d99kris/rapidcsv/issues/220"},{"type":"WEB","url":"https://github.com/d99kris/rapidcsv/releases/tag/v8.99"},{"type":"ADVISORY","url":"https://github.com/d99kris/rapidcsv/security/advisories/GHSA-v83v-8j5q-6553"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49206"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/d99kris/rapidcsv","events":[{"introduced":"0"},{"fixed":"68f57cc6c83d5e0992904398822453489d8dfac1"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"8.99"}],"source":"AFFECTED_FIELD"}}],"versions":["v8.97","v8.92","v8.90","v8.89","v8.88","v8.87","v8.85","v8.84","v8.83","v8.82","v8.80","v8.77","v8.75","v8.69","v8.30","v8.65","v8.64","v8.62","v8.53","v8.52","v8.51","v8.50","v8.48","v8.46","v8.43","v8.42","v8.40","v8.20","v8.00","v7.00","v6.11","v4.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49206.json","vanir_signatures":[{"id":"CVE-2026-49206-7af192c5","signature_type":"Line","signature_version":"v1","source":"https://github.com/d99kris/rapidcsv/commit/68f57cc6c83d5e0992904398822453489d8dfac1","target":{"file":"src/rapidcsv.h"},"deprecated":false,"digest":{"line_hashes":["91361359277715883996309089485197736246","29110684032673463642928644363621240174","24911736248858364756456888216381454189","68002198816432981847781796062602844987","185826000518453249259023189854435178314","338515666838742779097790441361327122204","300982185086558588234655177711974456841","111769676643878331767414578218147846643","256172871403351936426984691571855864190","22990313147895497919297107001134841308","241373696602035644817044515284163279686","208084585642364148995323341603463694872","256758171425128290057472567928677996320","28895635563471891833261101045812470149","298852619167460459283706643317976736208","144294906726849276658928908697917187047","30332546176139497177235209791790157141","57798241800714485168881979112222713963","167584987025329965697473033828184489285","252179980617351079874085530080025826698","158488307933798563905777408162587114830"],"threshold":0.9}}],"vanir_signatures_modified":"2026-10-15T07:08:38Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}