CVE-2026-110753 Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.
An attacker can cause a denial of service by triggering a use-after-free in Text::CSV_XS when parsing empty lines with specific options.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-110753?
CVE-2026-110753 is a critical use after free vulnerability, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline.
With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it. When skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line.
The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.
Which versions are affected by CVE-2026-110753?
How do I fix CVE-2026-110753?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-110753 being exploited?
There is no known exploitation of CVE-2026-110753 in the wild and no public exploit code.
Sources
Also known as AZL-109748, DEBIAN-CVE-2026-110753, GHSA-gvjh-vp76-v2mp, UBUNTU-CVE-2026-110753.