Use-After-Free Vulnerability in Text::CSV_XS for Perl
CVE-2026-110753

Currently unrated

Key Information:

Status
Vendor
CVE Published:
16 October 2026

What is CVE-2026-110753?

The Text::CSV_XS module for Perl contains a use-after-free vulnerability related to the handling of bind_columns variables. When the parser processes an empty line with skip_empty_rows, it incorrectly frees the current field scalar despite the fact that it remains referenced by the application. This flaw allows later code to access freed memory, potentially leading to application crashes and unpredictable behavior. Users should update to version 1.65 or later to mitigate this issue.

References

https://github.com/cpan-authors/Text-CSV_XS/commit/f082d5...
patch
https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/cha...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.