Live › vulnerability › CVE-2026-110753
Go to dashboardText::CSV_XS, a Perl module for reading and writing CSV, frees a variable the application still holds when it skips an empty line. Later reads of that memory can crash the Perl process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
print $Text::CSV_XS::VERSION and see whether it is 1.46 or higher but below 1.65bind_columns and grep -rn skip_empty_rows in your Perl codeUpgrade Text::CSV_XS to 1.65 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.
With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.
The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
This page as .md · .json · in your agent: get_signal("CVE-2026-110753")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.