CVE-2026-110758

Received Received - Intake

Heap Buffer Overflow in Text::CSV_XS Perl Module

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: CPANSec

Description

Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there. Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-18

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-110758

EUVD

EUVD-2026-103198

Affected Vendors & Products

Vendor	Product	Version / Range
perl	text	to 1.65 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-127	The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.

Attack-Flow Graph

Executive Summary

Text::CSV_XS versions before 1.65 for Perl have a flaw in how they handle whitespace in CSV fields when allow_whitespace and strip_trail_whitespace are enabled. For fields containing only blanks, the code reads before the field's buffer start, potentially zeroing adjacent memory if the preceding byte is a space or tab. This occurs due to improper boundary checks during trailing whitespace removal.

Detection Guidance

This vulnerability affects Perl's Text::CSV_XS module versions before 1.65. To detect it, check the installed version of Text::CSV_XS using the command: perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION' If the version is less than 1.65, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker to corrupt memory or cause crashes in Perl applications using Text::CSV_XS. It may lead to denial-of-service conditions or unexpected behavior if maliciously crafted CSV data is processed. Systems relying on CSV parsing for critical functions could be disrupted.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level memory corruption issue in a Perl CSV parsing library. It may indirectly impact compliance if exploited to manipulate or corrupt data processed by affected systems, but no direct regulatory impact is described.

Mitigation Strategies

Upgrade Text::CSV_XS to version 1.65 or later immediately. Use the command: cpan Text::CSV_XS or cpanm Text::CSV_XS to install the latest version. If upgrading is not possible, avoid using the allow_whitespace and strip_trail_whitespace features in the module.

Hi! I’m here to help you understand CVE-2026-110758. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70