Skip to main content

Text::CSV_XS CVE-2026-7111

| EUVDEUVD-2026-26237 HIGH
Expired Pointer Dereference (CWE-825)
2026-04-29 CPANSec
Buffer Overflow Text Hmbrand
8.4
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.2 MEDIUM

AC:H because it requires app-registered callbacks plus a precisely-timed stack reallocation; A:H for crashes, with only limited C:L/I:L from type confusion since code execution is unproven.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Source Code Evidence Fetched
Jul 24, 2026 - 05:50 vuln.today
Analysis Generated
Jul 24, 2026 - 05:50 vuln.today
CVSS changed
Apr 29, 2026 - 19:22 NVD
8.4 (None) 8.4 (HIGH)
EUVD ID Assigned
Apr 29, 2026 - 14:45 euvd
EUVD-2026-26237
Patch released
Apr 29, 2026 - 14:45 nvd
Patch available
CVE Published
Apr 29, 2026 - 14:22 nvd
HIGH 8.4

DescriptionCVE.org

Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.

The Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.

Calling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.

AnalysisAI

Memory corruption in the Text::CSV_XS Perl module (all versions before 1.62) occurs when application-registered callbacks such as after_parse, before_print, or on_error extend the Perl argument stack during Parse, print, getline, or getline_all, causing a use-after-free through a stale stack pointer. Affected code receives the Text::CSV_XS object instead of parsed rows, producing logic errors, crashes, or potential type confusion. EPSS is 0.01% and there is no public exploit identified at time of analysis, though the fix commit ships a sandbox reproducer.

Technical ContextAI

Text::CSV_XS is a high-performance XS (C-backed) CPAN module and the de facto fast CSV parser for Perl (CPE cpe:2.3:a:hmbrand:text::csv_xs). The root cause is CWE-825 (expired/stale pointer dereference): the XS layer caches the Perl argument stack pointer (via ST(0)) across a callback invocation, then writes the return value through that cached pointer with XSRETURN(1). When a callback pushes enough values to force Perl to reallocate (realloc) the argument stack, the cached pointer references freed memory. The 1.62 fix introduces a PUT_RETURN macro that issues SPAGAIN to refresh the stack pointer before writing ST(0), and also hardens SetDiag and getline_all argument handling by using named prototyped SV* parameters instead of raw ST(n) indexing.

RemediationAI

Vendor-released patch: Text::CSV_XS 1.62 - upgrade to 1.62 or later from CPAN, which refreshes the stack pointer (SPAGAIN) before writing return values (fix commit https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch; changelog https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes). Debian LTS users should apply the distribution update at https://lists.debian.org/debian-lts-announce/2026/06/msg00037.html. If immediate upgrade is not possible, a targeted workaround is to avoid or remove registered callbacks (after_parse, before_print, after_in, on_error) on Text::CSV_XS objects, since objects without callbacks are unaffected - the trade-off is loss of any per-row hook logic your application relies on. Where callbacks are essential, ensure they do not push extra values onto the Perl stack (return a simple scalar such as 1 or undef without growing the argument stack), understanding this is a fragile stopgap and full remediation still requires the 1.62 upgrade.

More in Text

View all
CVE-2018-3299 HIGH
8.2 Oct 17

Vulnerability in the Oracle Text component of Oracle Database Server. Rated high severity (CVSS 8.2), this vulnerability
CVE-2020-14734 HIGH
8.1 Oct 21

Vulnerability in the Oracle Text component of Oracle Database Server. Rated high severity (CVSS 8.1), this vulnerability
CVE-2026-7040 HIGH
7.5 Apr 27

Denial of service in the Perl module Text::Minify::XS (v0.3.0 up to but excluding v0.7.8) arises because its minify func
CVE-2022-32149 HIGH POC
7.5 Oct 14

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take sign
CVE-2020-14040 HIGH
7.5 Jun 17

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder ent
CVE-2021-2328 HIGH
7.2 Jul 21

Vulnerability in the Oracle Text component of Oracle Database Server. Rated high severity (CVSS 7.2), this vulnerability
CVE-2026-8594 MEDIUM
6.2 May 30

Resource amplification in Text::LineFold (Unicode-LineBreak Perl distribution, versions through 2019.001) causes output

CVE-2021-2045 LOW
3.1 Jan 20

Vulnerability in the Oracle Text component of Oracle Database Server. Rated low severity (CVSS 3.1), this vulnerability

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2026-58592 HIGH POC
8.9
CVE-2025-49795 HIGH POC
7.5
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-53006 CRITICAL
9.8
CVE-2026-52924 CRITICAL
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected

Share

CVE-2026-7111 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy