CVE-2026-110756: Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Text-CSV_XSto a version that resolves this vulnerability.Fixed in 1.65
Event History
Frequently Asked Questions
What conditions are required to trigger the data corruption?
The affected print path must write a record containing a UTF-8 flagged field followed by invalid UTF-8 bytes. The failure occurs when trailing invalid bytes are held back at a buffer flush and are never written after the record's final flush.
Which operations are affected?
Only print is described as affected. combine is not affected.
How can this appear in generated CSV output?
The final invalid byte, any closing quote, and the line ending can be omitted even though print returns true. A subsequent record may be appended to the same line; if the final field was quoted, CSV readers may interpret following records as part of that unclosed field.
Which versions need remediation?
Text::CSV_XS versions before 1.65 are affected. Upgrade to version 1.65 or later.