Quick answers
- Is CVE-2026-110756 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-110756 being exploited in the wild.
- How severe is CVE-2026-110756?
- Informational severity, published 16 October 2026.
- Which products and versions are affected?
- CPAN Text::CSV XS before 1.65.
- Is there a fix for CVE-2026-110756?
- Yes: fixed in Text::CSV_XS 1.65. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-110756 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-110756?
- Check whether you run CPAN Text::CSV XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Text::CSV_XS 1.65
Technical details
When Text::CSV_XS's print function processes a record with a UTF-8 flagged field, it buffers up to 16 trailing bytes that are not valid UTF-8 from each buffer flush to handle multi-byte UTF-8 characters split across buffer boundaries. However, after the final flush of a record, these held-back bytes are discarded without being written, along with any closing field quote and line ending. This affects print only; the combine function is unaffected. A record's last field ending in a byte ≥0x80 loses that byte, the closing quote (if any), and the newline, causing the next record to be written on the same line and potentially misparsed.
Affected products
- CPAN Text::CSV_XS before 1.65
Timeline
- 2026-10-16: disclosed