Data Handling Flaw in Text::CSV_XS for Perl by HMBRAND

CVE-2026-110759

What is CVE-2026-110759?

A data handling flaw in Text::CSV_XS for Perl occurs when the parser incorrectly processes an empty last field followed by a lone carriage return (CR). This results in the addition of a 0xFF byte—an unexpected input that doesn't originate from the actual data. Specifically, when parsing data strings that end with a separator followed by a lone CR, the input is treated incorrectly, leading to malformed UTF-8 strings. Consequently, applications relying on proper data formatting may experience errors or unexpected behavior, particularly when handling UTF-8 flagged input.

References