Vulnerability · Published Oct 16, 2026 · Assigned by CPANSec
CVE-2026-110753Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
Critical 9.8
In plain English
A critical-severity use-after-free in Text-CSV_XS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libtext-csv-xs-perl | no fix listed | DEBIAN-CVE-2026-110753 |
| Debian:13 | libtext-csv-xs-perl | no fix listed | DEBIAN-CVE-2026-110753 |
| Debian:14 | libtext-csv-xs-perl | 1.65-1 | DEBIAN-CVE-2026-110753 |
| Ubuntu:22.04:LTS | libtext-csv-xs-perl | no fix listed | UBUNTU-CVE-2026-110753 |
| Ubuntu:24.04:LTS | libtext-csv-xs-perl | no fix listed | UBUNTU-CVE-2026-110753 |
| Ubuntu:26.04:LTS | libtext-csv-xs-perl | no fix listed | UBUNTU-CVE-2026-110753 |
| Ubuntu:26.10 | libtext-csv-xs-perl | no fix listed | UBUNTU-CVE-2026-110753 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Text-CSV_XS | 1.46 – before 1.65 |
Weakness: CWE-416, CWE-911 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H