IT SBIT Services
Schneeberger
DEEN
CVE tracker

Text::CSV_XS: Lost record end and line ending in print() with invalid UTF-8

CVE-2026-110756Critical 9.8

← All vulnerabilities

Summary

Text::CSV_XS for Perl before version 1.65 can drop the last bytes of a record, any closing quote and the line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in the last field and print() is used. print() still returns true, so the error is not reported. The next record is then written onto the same line, or, if the last field was quoted, the missing quote causes a reader to merge all following records into one field. The CNA rates the issue 9.8 (Critical), while VulDB scores it 5.5, and the impact is silent data corruption in CSV output rather than code execution. combine() is not affected.

Affected

  • Text-CSV_XS for Perl, all versions before 1.65 (CNA data; VulDB lists up to 1.64)
  • Azure Linux package lists versions up to 1.60-1 as affected

Fixed in

  • Text-CSV_XS 1.65 or later
  • Mageia 10: perl-Text-CSV_XS 1.650.0-1.mga10 or later
  • Fedora 43 and 44: updates listed by Tenable; exact package versions to be checked in the Fedora advisories
  • Debian, Ubuntu, RHEL and SUSE: exact fixed package versions not verified; check the vendor advisories

Workaround

  • No vendor workaround known. Upgrading is the reliable fix.
  • Until patched, validate UTF-8 strictly before strings reach print() and reject or repair invalid byte sequences in untrusted fields (not tested).
  • Check generated CSV files for missing line endings or unbalanced quotes. This detects the problem but does not prevent it.

Exploitation

  • CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
  • No evidence of exploitation in the wild found. Public exploit code: none found.

Our recommendation

  • Upgrade Text-CSV_XS to 1.65 or later, or install the fixed distribution package, on all systems that generate CSV output with print().
  • Identify Perl scripts and applications that use Text::CSV_XS print() with decoded and undecoded fields in the same record.
  • Check existing CSV exports for missing line endings or unclosed quotes and regenerate affected files.
  • Prefer combine() where possible until patching is complete, after verifying the output in your own environment.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:35.

Original description (NVD)

Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected. The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed