Text::CSV_XS EUVD-2026-103192

The affected application must pass a request-supplied (attacker-controlled) RFC 7111 fragment string to Text::CSV_XS's fragment() or csv() method using a row=, col=, or cell= range selector; the library then expands the selector into one array element per index before reading data, and does not clamp an explicit end column in a cell= selector to the row. Exploitation is LIMITED to deployments that route untrusted input into this fragment feature - libraries or applications that do not use RFC 7111 selectors, or that build selectors only from trusted values, are not exploitable. No authentication or user interaction is required by the library itself (PR:N/UI:N per CVSS). A notable aggravating factor: the Out-of-memory failure terminates the process and cannot be caught by Perl eval, so application-level exception handling is not a mitigation - only upgrading to 1.65 or validating/bounding selector ranges before use is.

This is a genuine but conditional availability risk, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H, score 7.5) reflects a pure denial-of-service: no confidentiality or integrity impact, only process termination via memory exhaustion (CWE-770). The signals are internally consistent on impact but diverge on likelihood: EPSS is very low (0.19%, 8th percentile) and the CVE is NOT on CISA KEV, indicating no observed or probable widespread exploitation. There is no standalone weaponized exploit, although the vendor patch ships a regression test that demonstrates the exact trigger (row=1-400000000 on a two-line file). The AV:N rating is defensible only because the vulnerable fragment/csv selector can be request-supplied by a web-facing application - but exploitability hinges entirely on whether an application actually routes untrusted input into the RFC 7111 fragment selector, which is NOT the default or common usage pattern for this library. An aggravating factor noted in the description: the resulting Out-of-memory error ends the process and cannot be caught by Perl eval, so defensive exception handling does not mitigate it. Net: prioritize patching for any Perl service that exposes CSV fragment selectors to untrusted input; for all other deployments this is low urgency.

A Perl web application lets users specify an RFC 7111 fragment (e.g. a row/column range) and passes it straight to Text::CSV_XS fragment() or csv(). An attacker submits a selector such as row=1-400000000, causing the library to pre-allocate one array element per selector index - roughly 400 million entries - before reading any data, exhausting memory and killing the worker process with an uncatchable Out-of-memory error. No public weaponized exploit exists, but the vendor's own patch includes a regression test proving the condition.