CVE-2026-110753: Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline.
With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.
The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Text::CSV_XSto a version that resolves this vulnerability.Fixed in 1.65
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Text::CSV_XS from version 1.46 before 1.65 are exposed only when they use getline with bind_columns and an empty line is skipped. The documented skip_empty_rows behavior affects an empty last line, while eof mode can trigger the issue on any empty line.
What input or configuration is required to trigger the crash?
An attacker or input source must be able to cause the CSV parser to process an empty line under the affected conditions. The application must bind output columns to its own scalars using bind_columns; the parser can then free a scalar that the application later uses.
What can happen after successful exploitation?
Later application code can use memory that has already been freed, causing the process to crash. The provided information describes a use-after-free and crash condition.
What should teams do if they cannot immediately upgrade?
Avoid combining getline with bind_columns when empty rows may be processed or skipped. In particular, avoid the affected skip_empty_rows behavior for an empty final line and eof mode where empty lines can occur.