Use-After-Free Vulnerability in Text::CSV_XS by Perl
CVE-2026-7111
What is CVE-2026-7111?
The Text::CSV_XS module for Perl contains a use-after-free vulnerability when registered callbacks manipulate the Perl argument stack, potentially leading to type confusion or memory corruption. Specifically, the methods 'Parse', 'print', 'getline', and 'getline_all' utilize registered callbacks that cache the argument stack pointer. If a callback causes the argument stack to be reallocated, this can result in writing the return value through a stale pointer into a previously freed buffer. Consequently, the caller might retrieve an incorrect parsed value, such as receiving a Text::CSV_XS object instead of the expected data. This issue primarily affects environments using registered callbacks, while standard usage without callbacks remains secure.
Affected Version(s)
Text::CSV_XS 0 < 1.62