Text-CSV_XS: Use-after-free of bound variables in skip_empty_rows
Summary
Text::CSV_XS for Perl frees a variable bound with bind_columns when skip_empty_rows skips an empty line, in 'skip' mode for a trailing empty line or in 'eof' mode for any empty line. The application still references that variable, so later code uses freed memory, which can crash the process. The CNA rates the issue CVSS 9.8 (critical), but the described impact is a crash, and no exploitation has been reported.
Affected
- Text-CSV_XS for Perl, versions 1.46 to before 1.65
- Only applications that use bind_columns together with skip_empty_rows (skip or eof) are affected
Fixed in
- Text-CSV_XS 1.65 or later
- Distribution packages must be checked for their own versions, as they can differ from upstream
Workaround
- No vendor workaround. The fix is the upgrade to 1.65 or later.
- Interim measure (not from the vendor): until the upgrade is done, avoid combining skip_empty_rows with bind_columns and check internal scripts for this combination
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- No known exploitation in the wild and no public proof of concept found at the time of writing
- The fix commit is public
Our recommendation
- Inventory Perl applications that use Text::CSV_XS, especially those with bind_columns or skip_empty_rows
- Upgrade to Text-CSV_XS 1.65 or later, or to a distribution package that includes the fix
- Prioritise applications that parse CSV from untrusted sources, such as internet-facing uploads or imports
- Monitor scheduled jobs for crashes after the upgrade
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CPAN Security Group advisory (oss-security) www.openwall.com
- Text-CSV_XS 1.65 changelog metacpan.org
- Fix commit f082d5c8 (patch) github.com
- OSV: CVE-2026-110753 osv.dev
- Ubuntu security status CVE-2026-110753 ubuntu.com
- Mageia advisory MGASA-2026-0563 vulners.com
- Tenable CVE-2026-110753 www.tenable.com
- OSV: Azure Linux AZL-109748 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:35.
Original description (NVD)
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.