CVE-2026-110753 in Text::CSV_XS
Summary
by MITRE • 10/17/2026
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.
With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.
The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/17/2026
Text::CSV_XS versions ranging from 1.46 up to but not including 1.65 for Perl contain a critical use-after-free vulnerability within the bind_columns functionality when processing CSV data with empty rows enabled. This flaw specifically manifests during the execution of the getline method, where the parser is configured to skip empty lines via the skip_empty_rows option or operates in eof mode. The core technical deficiency lies in how the module manages memory references for bound variables. When using bind_columns, Text::CSV_XS writes parsed fields directly into scalar variables provided by the caller without creating a new reference to those scalars within its own internal data structures. This design choice relies on the application maintaining ownership of the variable's lifecycle while allowing the parser to populate it efficiently. However, this model creates a race condition-like scenario regarding memory management when empty lines are encountered at specific points in the input stream.
The vulnerability occurs because the parser fails to verify whether a field scalar is currently bound to an external variable before attempting to free or reset its internal state during line processing. Specifically, when skip_empty_rows causes the parser to bypass an empty last line, it proceeds to free the current field scalar without checking if that memory location corresponds to one of the caller's bound variables. This action effectively drops a reference count from the application's variable prematurely. Similarly, in eof mode, the same erroneous behavior is triggered on any empty line encountered during parsing. Consequently, the underlying memory associated with the field is deallocated while the Perl interpreter still holds an active reference to it through the user-defined scalar.
This use-after-free condition leads directly to undefined behavior within the Perl runtime environment. Subsequent operations that attempt to access or modify these freed variables result in reading from invalid memory addresses or writing to released heap space. In practical terms, this instability typically manifests as a segmentation fault causing an immediate crash of the processing process. For applications relying on Text::CSV_XS for high-volume data ingestion, such crashes can lead to significant service interruptions and potential denial-of-service conditions. Furthermore, depending on the specific memory allocator state and subsequent allocation patterns, there is a theoretical risk that this corruption could be exploited to execute arbitrary code or leak sensitive information from adjacent memory regions, although immediate crashability is the primary observed impact.
From a classification perspective, this vulnerability aligns with CWE-416 Use After Free, which describes situations where software uses an address in memory after it has been reused for another purpose. It also relates to CWE-787 Out-of-bounds Write if the freed memory is reallocated and overwritten before being accessed again by the vulnerable code path. In terms of attack vectors, this falls under ATT&CK technique T1496 Resource Hijacking or potentially T1053 Scheduled Task/Job if exploited in a way that disrupts scheduled data processing jobs, though primarily it represents a stability issue rather than an active exploitation vector for privilege escalation unless combined with other memory corruption flaws.
Mitigation strategies focus on upgrading the software dependency to version 1.65 or later of Text::CSV_XS, where this reference counting logic has been corrected to properly account for bound variables before freeing internal structures. Developers should also review their CSV parsing implementations to ensure that skip_empty_rows and eof modes are used with awareness of memory management implications in older versions if upgrading is not immediately feasible. Implementing input validation and sanitization at the ingestion layer can help reduce exposure, but the root cause requires a patch to the library itself. Regular auditing of Perl module dependencies for known vulnerabilities is essential to maintain system integrity against such low-level memory errors that compromise process stability.