Description
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.

Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.

Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.
Published: 2026-10-16
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Memory corruption
Action: Apply patch
AI Analysis

Impact

Text-CSV_XS before 1.65 contains a bug in the strip_trail_whitespace routine that can read bytes before the start of an all‑blank field when allow_whitespace is enabled. This off‑by‑one read can expose or overwrite adjacent memory, potentially causing data corruption or a crash. The vulnerability does not expose a directly documented code‑execution path, but memory corruption can lead to severe local compromise if an attacker controls the input.

Affected Systems

Perl modules Text‑CSV_XS versions 1.64 and earlier are affected. The bug arises when allow_whitespace is true and strip_trail_whitespace is used. Users of these legacy versions on any platform running Perl are at risk.

Risk and Exploitability

The EPSS score is below 1% and the vulnerability is not listed in CISA KEV. The CVSS score of 7.5 indicates high potential for damage if exploited. Memory‑corruption bugs remain high‑risk when an attacker can supply crafted CSV input; the likely attack vector is local or remote code execution through parsing of a malicious CSV file, depending on privileges.

Generated by OpenCVE AI on October 22, 2026 at 22:55 UTC.

Remediation

Vendor Solution

Upgrade to Text-CSV_XS 1.65 or later.

OpenCVE Recommended Actions

  • Upgrade Text-CSV_XS to version 1.65 or newer.
  • If you cannot upgrade immediately, set allow_whitespace to false or disable strip_trail_whitespace for fields that may be all blanks.
  • Validate or sanitize CSV input before parsing to ensure no malformed or all‑blank fields are processed.

Generated by OpenCVE AI on October 22, 2026 at 22:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Hmbrand
Hmbrand text::csv Xs
Vendors & Products Hmbrand
Hmbrand text::csv Xs

Tue, 20 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-124
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 16 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Description Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there. Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.
Title Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace
Weaknesses CWE-127
References

Subscriptions

Hmbrand Text::csv Xs
cve-icon MITRE

Status: PUBLISHED

Assigner: CPANSec

Published:

Updated: 2026-10-20T18:31:16.823Z

Reserved: 2026-10-14T17:07:36.990Z

Link: CVE-2026-110758

cve-icon Vulnrichment

Updated: 2026-10-20T18:30:26.015Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-16T23:17:01.057

Modified: 2026-10-20T19:17:30.300

Link: CVE-2026-110758

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-16T22:08:10Z

Links: CVE-2026-110758 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T23:00:14Z

Weaknesses
  • CWE-124

    Buffer Underwrite ('Buffer Underflow')

  • CWE-127

    Buffer Under-read