CVE-2026-110753

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110753
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110753.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110753
Downstream
Related
Published
2026-10-16T22:06:23Z
Modified
2026-10-22T17:27:11Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
Details

Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.

With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.

The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-416",
        "CWE-911"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110753.json"
}
References

Affected packages

Git / github.com/cpan-authors/text-csv_xs

Affected ranges

Type
GIT
Repo
https://github.com/cpan-authors/text-csv_xs
Events
Introduced
7a419a4e781af4f5388b25cc6f5b75449b7234fa
Fixed
84085bcda35b916ff251e433cc5b7a1cf04066f5
Fixed
f082d5c8aab1b8d16b6181d4f3042a06947e260f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "1.46"
                },
                {
                    "fixed":  "1.65"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "f082d5c8aab1b8d16b6181d4f3042a06947e260f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.46
1.47
1.48
1.49
1.50
1.51
1.53
1.54
1.55
1.56
1.58
1.59
1.60
1.61
1.62
1.63
1.64

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110753.json"