EUVD-2026-103196
GHSA-fvcq-fpcj-xxcc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply UTF-8-flagged field before invalid UTF-8 bytes
-
Exploitprint() withholds trailing bytes at final flush
-
ExecutionRecord loses terminator and closing quote
-
ImpactDownstream reader fuses/misparses CSV records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding for downstream
|
| Exploitation Conditions | Requires an application to serialize data with Text::CSV_XS print() (the combine() method is explicitly NOT affected) on versions before 1.65, running under PerlIO (the regression test skips when useperlio is not defined). The triggering data condition is concrete: a record must contain at least one UTF-8 flagged (decoded) field, and a subsequent field must end in bytes that are not valid UTF-8 - only then are the record's trailing byte, closing quote, and line ending dropped. Limiting factors: the attacker must influence the field values and their encoding state being written, the application must use print() rather than combine(), and the flaw manifests as corrupted output rather than code execution; there is no authentication bypass or memory-safety primitive. |
| Impact | The signals conflict sharply and the headline CVSS score should NOT drive prioritization. NVD assigns CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) with C:H/I:H/A:H, which is almost certainly an inflated/automated score: the actual defect (CWE-116, improper output encoding) is a data-corruption bug in a CSV *writer*, not remote code execution or information theft. There is no plausible confidentiality or availability impact, so C:H and A:H are unjustified; the true damage is to output integrity. Corroborating signals agree this is low urgency: EPSS is 0.19% (8th percentile), the CVE is NOT in CISA KEV, and no public exploit code exists (the commit includes only a regression test, not a weaponized PoC). No SSVC decision record was provided. Explicit discrepancy: CVSS claims AC:L/PR:N network-exploitable critical impact, but the description shows a narrow, condition-dependent output-corruption flaw triggered only when an application serializes specific field encodings via print() - verify the inflated score with the vendor/NVD rather than treating 9.8 as real priority. |
| Exploit ScenarioDerived | An application uses Text::CSV_XS print() to serialize records where one field has been UTF-8 decoded (flagged) and a later field ends in bytes that are not valid UTF-8; the final record's trailing byte, any closing quote, and the line ending are silently dropped while print() still returns true. A downstream consumer then either reads two records fused onto one line or, if the field was quoted, treats all following records as part of one unterminated quoted field, corrupting the parsed dataset. No public exploit code exists at time of analysis; the vendor commit ships only a regression test demonstrating the condition. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Text::CSV_XS versions before 1.65 for Perl silently corrupt the final record written with print() when a UTF-8 flagged (decoded) field is followed by a field ending in bytes that are not valid UTF-8: the held-back trailing byte, any closing quote, and the line ending are never flushed, yet print() still returns true. The practical result is fused records - the next record lands on the same line, or, in the quoted case, the missing close quote makes downstream readers absorb every following row into that field - an integrity impact on generated CSV rather than code execution. According to CISA KEV no active exploitation is confirmed and no public exploit code was identified at time of analysis; EPSS is 0.19% (8th percentile), and the reported 9.8 AV:N/AC:L vector is not supported by the exploitation prerequisites, which require a specific mixed-encoding data condition.
RemediationAI
Upgrade to Text::CSV_XS 1.65 or later (CPAN release HMBRAND/Text-CSV_XS-1.65, changes at https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes); the essential fix is upstream commit 0610a8d81262ae6f1ac82a88d73c8a471f38af19, which flushes the held-back trailing bytes at the end of a print() record - patch file at https://github.com/cpan-authors/Text-CSV_XS/commit/0610a8d81262ae6f1ac82a88d73c8a471f38af19.patch. If immediate upgrade is not possible, the most effective compensating control is to normalize encoding before serialization: decode every field to a consistent UTF-8 flagged form (or downgrade all of them to consistent raw bytes) so no record mixes flagged and invalid-UTF-8 byte fields, which removes the trigger condition entirely - the trade-off is that this changes the exact bytes written to disk and can alter downstream consumer expectations. Alternatively, build records with combine() (explicitly not affected) and write the resulting string directly, at the cost of holding a full record in memory rather than streaming. Do not simply retry or ignore print() return values as a detection strategy - the buggy version returns true while dropping data - instead validate generated output with a strict CSV parser or assert that each record ends with the expected line terminator, and treat any row-count mismatch between writer and reader as corruption. Where untrusted data feeds the writer, restrict or sanitize fields that may arrive as non-UTF-8 byte strings until the upgrade is deployed.
Affected ProductsAI
All releases of Text::CSV_XS for Perl before 1.65 (the fix ships in Text::CSV_XS 1.65, released by HMBRAND on CPAN; see https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.65/changes). Affected deployments are Perl applications on any OS that use the module's print() method under a PerlIO-enabled build of Perl to serialize records where a UTF-8 flagged field is followed by a field ending in bytes that are not valid UTF-8. Applications that only use combine(), or that never mix decoded and raw-byte fields in a single record, are not exposed. No CPE identifiers were supplied with this CVE, so inventory matching must rely on installed module version (perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION') and on generated-file evidence; the upstream advisory thread is at https://seclists.org/oss-sec/2026/q4/213 and the NVD/EUVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-110756.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Text::CSV_XS is a Perl XS (C-level) CSV reader/writer widely used for parsing and generating delimited files. Its print() path writes through PerlIO in buffered flushes, and when the record contains a UTF-8 flagged scalar it deliberately holds back trailing bytes that do not form a complete UTF-8 sequence at each flush boundary, so an encoded character split across two flushes can be completed by the next one. The final flush of a record never revisits that held-back buffer, so those bytes are discarded along with the closing quote and end-of-line sequence that would have followed. The CWE-116 (improper encoding/escaping of output) classification fits: the serializer emits structurally invalid output because a buffered fragment is dropped rather than escaped or written through. The upstream fix in commit 0610a8d8 adds a second, UTF-8-disabled Print() pass that flushes any remaining buffered bytes at end of record and propagates failure, plus regression tests in t/50_utf8.t that assert the trailing byte, closing quote, and EOL are present and that two records do not merge. The defect is specific to the print() path - the combine() method is explicitly not affected - and manifests only under PerlIO; the new tests skip when useperlio is undefined, and it also requires attacker-influenced field values where at least one field is UTF-8 flagged and a later field ends in invalid-UTF-8 bytes. No memory-safety primitive, authentication bypass, or disclosure of memory contents is involved, which is why the independent assessment scores it C:N/I:L/A:N rather than high across all three impact categories.
Know when Perl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H because exploitation needs a specific UTF-8-flagged-then-invalid-byte sequence via print() under PerlIO; impact is integrity-only output corruption (I:L), with no confidentiality or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print.
When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character split across two flushes can be completed. Nothing writes the held-back bytes after the record's final flush. A record whose last field ends in such a byte loses it, any closing quote and the line ending, while print still returns true. combine is not affected.
The next record is written onto the same line, or, when the last field was quoted, the missing closing quote makes a reader take every following record as part of that field.
Executive ViewAI
Text::CSV_XS, a widely used Perl module for generating CSV files, can silently corrupt the final record in an export when a UTF-8-flagged field is followed by bytes that are not valid UTF-8, causing records to merge onto one line or downstream readers to absorb all following rows into a single field. Because the write operation still reports success, teams may distribute or ingest inaccurate CSV data without any error signal, affecting reporting, billing, and data-exchange workflows that rely on Perl. Leadership should care because this is a silent data-integrity failure with potential downstream financial and operational consequences, even though no public exploit has been identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Silently incorrect regular-expression matching in the Perl interpreter (all versions through 5.43.9) lets an oversized a
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers
Exploit-DB