RapidCSV is a C++ CSV parser library vulnerable to an integer overflow in iterator arithmetic. The overflow occurs when size_t indexes are converted to int before being added to std::vector iterators in functions such as RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames. On 64‑bit systems, indexes larger than INT_MAX can wrap into negative offsets, causing the iterator to point before the start of the underlying vector. This results in undefined behavior that may manifest as heap memory corruption, crashes, or other unpredictable program behavior. The weakness is an improper conversion leading to integer overflow and an out‑of‑bounds access, corresponding to CWE-190 and CWE-787.

The flaw affects the rapidcsv library distributed by developer d99kris, in all released versions prior to 8.99. Any application embedding an affected RapidCSV binary that processes a CSV matrix containing more than 2^31 elements is potentially vulnerable. The problem is limited to the library’s RemoveColumn, InsertColumn, RemoveRow, InsertRow, and GetColumnNames functions.

The CVSS score of 2.9 indicates a low severity, and the EPSS score of less than 1% indicates a very low exploitation probability, consistent with the low CVSS severity. Because the vulnerability requires creating an in‑memory CSV matrix with tens of gigabytes to trigger the overflow, success conditions demand significant memory and a large malformed input. This reduces practical exploitability in typical deployment environments. No exploit has been observed, and the vulnerability is not listed in the CISA KEV catalog.