Description
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.

With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.

The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
Published: 2026-10-16
Score: n/a
EPSS: n/a
KEV: No
Impact: Denial of Service (crash)
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a use‑after‑free in Text::CSV_XS that frees a scalar variable that the caller has bound to. If the parser skips an empty line while in skip_empty_rows mode, it deletes the bound scalar without checking that it is still in use. The application later accesses this freed memory, which can cause the process to crash.

Affected Systems

Perl modules using Text::CSV_XS version 1.46 through 1.64, inclusive, on CPAN. These versions are incompatible with any Perl program that employs bind_columns together with skip_empty_rows or enables eof mode on empty lines.

Risk and Exploitability

Because the flaw is triggered by specific input handling and requires the application to use bind_columns, the risk is primarily local and results in a denial‑of‑service via crash. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating it has not yet become a widely exploited threat. Nonetheless, any environment that processes CSV input with this module should treat it as a moderate‑to‑high risk until patched.

Generated by OpenCVE AI on October 16, 2026 at 23:17 UTC.

Remediation

Vendor Solution

Upgrade to Text-CSV_XS 1.65 or later.

OpenCVE Recommended Actions

  • Upgrade Text::CSV_XS to version 1.65 or later. This version removes the use‑after‑free behavior.
  • If immediate upgrade is not possible, avoid using bind_columns together with skip_empty_rows or eof mode on inputs that may contain empty lines; instead preprocess input files to remove or replace trailing blank lines.
  • Ensure that any application‑level input handling validates or sanitizes CSV sources to avoid unnecessarily triggering the faulty parser logic.

Generated by OpenCVE AI on October 16, 2026 at 23:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Description Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
Title Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
Weaknesses CWE-416
CWE-911
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-10-16T22:06:23.680Z

Reserved: 2026-10-14T17:06:13.039Z

Link: CVE-2026-110753

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-16T23:17:00.530

Modified: 2026-10-16T23:17:00.530

Link: CVE-2026-110753

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T23:30:13Z

Weaknesses