# CVE-2026-110753: Text::CSV_XS use-after-free in bind_columns with skip_empty_rows

Source: https://junglewise.ai/threats/cve-2026-110753-text-csv-xs-versions-from-1-46-before-1-65-for-perl-have-a-use  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110753 · Severity: info · Published 2026-10-16

Text::CSV_XS is a Perl library for parsing CSV files. When using the bind_columns feature with skip_empty_rows enabled, the parser can incorrectly free a variable that the application still has a reference to, causing the process to crash or access freed memory. This affects Perl applications that parse CSV data with these features enabled.

Technologies: [CPAN Text::CSV XS](https://junglewise.ai/threats/technologies/cpan-text-csv-xs). Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-110753 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110753 being exploited in the wild.

**How severe is CVE-2026-110753?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** CPAN Text::CSV XS 1.46 to 1.64.

**Is there a fix for CVE-2026-110753?** Yes: fixed in 1.65. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110753 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-110753?** Check whether you run CPAN Text::CSV XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.65

## Technical details

The vulnerability is a use-after-free in the SkipEmptyRow macro when skip_empty_rows skips an empty line. The parser borrows the caller's scalar variable via bind_columns without taking a reference, but incorrectly calls sv_free() on it during row skipping, decrementing the caller's refcount and causing premature deallocation. Later code accessing the freed variable can crash or execute in freed memory. The fix guards the two sv_free() calls with is_bound checks, matching guards already present in error paths.

## Affected products

- CPAN Text::CSV_XS 1.46 to 1.64

## Timeline

- 2026-10-16: disclosed
- 2026-10-14: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/cpan-authors/Text-CSV_XS/commit/f082d5c8aab1b8d16b6181d4f3042a06947e260f.patch](https://github.com/cpan-authors/Text-CSV_XS/commit/f082d5c8aab1b8d16b6181d4f3042a06947e260f.patch)

## Related threats

- [Text::CSV_XS incorrect byte returned for empty field with trailing CR](https://junglewise.ai/threats/cve-2026-110759-text-csv-xs-versions-before-1-65-for-perl-return-a-0xff-byte)
- [Text::CSV_XS buffer over-read in strip_trail_whitespace](https://junglewise.ai/threats/cve-2026-110758-text-csv-xs-versions-before-1-65-for-perl-read-before-the-start)
- [Text::CSV_XS record splitting via unquoted numeric strings](https://junglewise.ai/threats/cve-2026-110757-text-csv-xs-versions-before-1-65-for-perl-allow-record-splitting)
- [Text::CSV_XS data corruption in print with UTF-8 and invalid bytes](https://junglewise.ai/threats/cve-2026-110756-text-csv-xs-versions-before-1-65-for-perl-drop-the-end-of-a)
- [Text::CSV_XS quadratic CPU use with CR-only input](https://junglewise.ai/threats/cve-2026-110755-text-csv-xs-versions-before-1-65-for-perl-allow-quadratic-cpu)