EUVD-2026-101286Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply oversized CSV to local app
-
DeliveryApp loads >2^31-element matrix in memory
-
ExploitCall affected column/row API
-
Executionsize_t index truncated to negative int offset
-
PersistIterator points before vector start
-
ImpactHeap corruption or crash (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the application (a) processes an attacker-controlled CSV loaded into memory as a matrix whose row or column dimension exceeds 2^31 (INT_MAX) elements, realistically demanding tens of gigabytes of RAM, and (b) subsequently invokes one of the affected APIs - RemoveColumn, InsertColumn, RemoveRow, InsertRow, or GetColumnNames - on that oversized structure. Limiting factors: the attack vector is local (AV:L) and complexity is high (AC:H) because the attacker must induce an extreme in-memory document size that typical CSV files never reach; impact is confined to availability (crash/heap corruption) with no confidentiality or integrity effect. Default use of the library on ordinary CSV documents is not practically affected. |
| Impact | This is a genuine integer-overflow bug (CWE-190) but a very low real-world priority, and the signals agree. The vendor CVSS of 2.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) correctly reflects that there is no confidentiality or integrity impact and only limited availability impact, with high attack complexity. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of exploitation. The decisive limiting factor is the trigger condition confirmed in the description and corroborated by the source diff: the size_t-to-int truncation only matters when a CSV matrix dimension exceeds 2^31 elements, which requires tens of gigabytes of in-memory data - an unrealistic state for virtually any production use of this library. The only mild tension is that PR:N implies no authentication while AV:L requires local processing of attacker-supplied data; these are consistent here because an application must load an enormous attacker-influenced document locally, not because remote unauthenticated exploitation is feasible. Bottom line: a legitimate correctness fix, not an operational security priority. |
| Exploit ScenarioDerived | An application using rapidcsv before 8.99 parses an attacker-supplied CSV and then calls RemoveColumn, InsertColumn, RemoveRow, InsertRow, or GetColumnNames on a matrix with more than 2^31 elements along a dimension. The index above INT_MAX wraps to a negative iterator offset pointing before the vector's start, causing heap corruption or a crash. No public POC is available, and the AV:L/AC:H profile plus the multi-gigabyte memory requirement make this impractical outside contrived conditions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Integer overflow (CWE-190) in the rapidcsv C++ header-only CSV parser prior to version 8.99 allows a local attacker to corrupt heap memory or crash a process that loads an attacker-supplied CSV into an in-memory matrix. The affected APIs - RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames - cast a size_t index to int before adding it to a std::vector iterator, so on 64-bit systems an index above INT_MAX wraps negative and points before the start of the buffer. Exploitation prerequisites are severe: the process must hold a matrix with more than 2^31 elements in a row or column (tens of gigabytes of RAM) and then call one of those APIs, so ordinary CSV workloads are not practically affected. No public exploit identified at time of analysis; the CVSS base score is 2.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L), and the fix is the vendor-released patch in v8.99.
RemediationAI
Vendor-released patch: upgrade rapidcsv to version 8.99 (release tag v8.99, fix commit 68f57cc6c83d5e0992904398822453489d8dfac1), which replaces the unsafe static_cast<int> iterator offsets with static_cast<std::ptrdiff_t> in RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames; see https://github.com/d99kris/rapidcsv/security/advisories/GHSA-v83v-8j5q-6553 and https://github.com/d99kris/rapidcsv/releases/tag/v8.99. Because rapidcsv is header-only, upgrading means re-vendoring or bumping the header in every downstream project and rebuilding - an inventory sweep of embedded copies is required, since package managers will not catch vendored sources. Where an immediate upgrade is impossible, the effective compensating control is to cap the in-memory matrix so no row or column can exceed INT_MAX (2^31) elements: enforce a hard reject on document dimensions at parse time plus an address-space limit (ulimit -v, cgroup memory.max, or an allocator cap) sized well below tens of gigabytes. The trade-off is that legitimate very large CSV processing is denied or aborted, but such documents are already beyond what this vulnerability's own prerequisites describe as practical, and failing closed via a controlled memory-allocation error is far safer than letting an out-of-range index corrupt the heap; note that this mitigation is application-side only and does not fix the library. Code that applies the fix manually should follow the upstream diff exactly, changing only the cast type so index arithmetic remains signed-64-bit for iterator offsets. No public exploit code was identified at time of analysis, and there is no evidence of active exploitation, so remediation can proceed on a normal patch cadence rather than an emergency one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
rapidcsv is a header-only C++ library (src/rapidcsv.h) that models a CSV document as a nested std::vector<std::vector<std::string>> matrix, with rows and columns accessed through size_t indexes. The root cause is CWE-190, Integer Overflow or Wraparound: five call sites downcast a size_t index to a plain int before arithmetic on a vector iterator, e.g. 'itRow->erase(itRow->begin() + static_cast<int>(dataColumnIdx))' and 'mData.erase(mData.begin() + static_cast<int>(dataRowIdx))'. Because int is 32-bit while size_t is 64-bit on the platforms in question, any index greater than INT_MAX (2,147,483,647) becomes negative during the conversion; the resulting negative iterator offset resolves to a location before begin(), which is undefined behavior - in practice heap corruption or a segmentation fault. The vendor fix (commit 68f57cc6c83d5e0992904398822453489d8dfac1, released as v8.99) replaces every static_cast<int> in these paths with static_cast<std::ptrdiff_t>, preserving the full index magnitude on 64-bit builds. The affected CPE is cpe:2.3:a:d99kris:rapidcsv:*:*:*:*:*:*:*:* for all versions before 8.99. This is not a parser-input bug (no malicious CSV syntax is needed); it requires an adversarial in-memory dimension, which is why the assessed vector is local with high attack complexity and availability-only impact.
Know when Rapidcsv gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Local processing of in-memory data gives AV:L; the multi-gigabyte, >INT_MAX trigger is an extreme precondition so AC:H; no auth needed (PR:N); only a crash, so C:N/I:N/A:L.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
rapidcsv is a C++ CSV parser library. Prior to 8.99, RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames converted size_t indexes to int before adding them to std::vector iterators. On 64-bit systems, in a CSV matrix dimension containing more than 2^31 elements, an index above INT_MAX could wrap to a negative iterator offset and point before the start of the vector, causing undefined behavior, heap memory corruption, or a crash. Triggering the issue requires an extremely large in-memory document, requiring tens of gigabytes of memory at minimum, so typical CSV documents are not practically affected. This issue is fixed in version 8.99.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Exploit-DB