CVE-2026-110758 in Text::CSV_XS
Summary
by MITRE • 10/17/2026
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace.
Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there.
Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in Text::CSV_XS prior to version 1.65 represents a critical out-of-bounds read and write condition within the Perl CSV parsing module. This flaw specifically manifests under specific configuration settings involving whitespace handling, namely when both allow_whitespace and strip_trail_whitespace are enabled. The core technical deficiency lies in the logic used to remove trailing spaces and tabs from unquoted fields. Instead of correctly identifying the boundary between a field's content and its delimiter or end-of-line marker, the parsing routine fails to stop at the start of an all-blank field. Consequently, when processing such a field, the parser reads memory bytes preceding the allocated heap buffer for that field. This behavior violates standard memory safety principles by accessing memory outside the designated allocation boundaries, creating a classic off-by-one or similar out-of-bounds access scenario.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution or denial of service through application crash. When the parser reads the byte immediately preceding the field's heap buffer, it does not merely inspect memory; under certain conditions, it may zero out that byte if it contains a space or tab character. This write operation into unallocated or unrelated memory regions can corrupt adjacent data structures, overwrite critical control flow information such as return addresses or function pointers in C-level extensions, or trigger segmentation faults depending on the Perl interpreter's memory allocator behavior and the specific layout of heap metadata. An attacker who can supply crafted CSV input containing fields composed entirely of whitespace characters could exploit this flaw to destabilize the running process or potentially execute malicious code if they have control over the surrounding memory context.
From a classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-bounds Read, and more critically CWE-787, Out-of-bounds Write, given that the parser may modify memory outside its allocated scope. The attack vector is typically classified under ATT&CK technique T1068, Exploitation for Privilege Escalation or Code Execution, as it involves manipulating input to trigger unintended behavior in a system component. Furthermore, CWE-20, Improper Input Validation, applies because the module fails to properly validate field boundaries before performing memory operations based on whitespace stripping logic. The vulnerability is particularly insidious because leading blanks are normally skipped during standard parsing, but edge cases involving escape characters that differ from quote characters or quoted fields ending in specific carriage return sequences can bypass these safeguards and expose the underlying buffer handling flaw.
Mitigation for this issue requires an immediate upgrade to Text::CSV_XS version 1.65 or later, where the developers have corrected the boundary checking logic within strip_trail_whitespace. Until such upgrades are implemented in production environments relying on older versions of the module, administrators should consider input sanitization strategies that restrict CSV inputs to well-formed data structures without excessive whitespace anomalies. Additionally, deploying runtime application self-protection tools or memory safety monitors can help detect abnormal memory access patterns associated with this specific exploitation vector. It is also advisable to review any custom parsing logic that relies on Text::CSV_XS for similar boundary assumptions and ensure that all dependencies are kept up-to-date to prevent exposure to known buffer handling defects in widely used Perl modules.