# CVE-2026-110756: Text::CSV_XS data corruption in print with UTF-8 and invalid bytes

Source: https://junglewise.ai/threats/cve-2026-110756-text-csv-xs-versions-before-1-65-for-perl-drop-the-end-of-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110756 · Severity: info · Published 2026-10-16

Text::CSV_XS is a Perl library for reading and writing CSV (comma-separated values) files. A bug in the print function causes the end of a CSV record to be silently lost when a field containing valid UTF-8 is followed by invalid UTF-8 bytes, resulting in data corruption where subsequent records merge into the same line or are misread by parsers.

Technologies: [CPAN Text::CSV XS](https://junglewise.ai/threats/technologies/cpan-text-csv-xs). Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-110756 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110756 being exploited in the wild.

**How severe is CVE-2026-110756?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** CPAN Text::CSV XS before 1.65.

**Is there a fix for CVE-2026-110756?** Yes: fixed in Text::CSV_XS 1.65. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110756 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-110756?** Check whether you run CPAN Text::CSV XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Text::CSV_XS 1.65

## Technical details

When Text::CSV_XS's print function processes a record with a UTF-8 flagged field, it buffers up to 16 trailing bytes that are not valid UTF-8 from each buffer flush to handle multi-byte UTF-8 characters split across buffer boundaries. However, after the final flush of a record, these held-back bytes are discarded without being written, along with any closing field quote and line ending. This affects print only; the combine function is unaffected. A record's last field ending in a byte ≥0x80 loses that byte, the closing quote (if any), and the newline, causing the next record to be written on the same line and potentially misparsed.

## Affected products

- CPAN Text::CSV_XS before 1.65

## Timeline

- 2026-10-16: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/cpan-authors/Text-CSV_XS/commit/0610a8d81262ae6f1ac82a88d73c8a471f38af19.patch](https://github.com/cpan-authors/Text-CSV_XS/commit/0610a8d81262ae6f1ac82a88d73c8a471f38af19.patch)

## Related threats

- [Text::CSV_XS incorrect byte returned for empty field with trailing CR](https://junglewise.ai/threats/cve-2026-110759-text-csv-xs-versions-before-1-65-for-perl-return-a-0xff-byte)
- [Text::CSV_XS buffer over-read in strip_trail_whitespace](https://junglewise.ai/threats/cve-2026-110758-text-csv-xs-versions-before-1-65-for-perl-read-before-the-start)
- [Text::CSV_XS record splitting via unquoted numeric strings](https://junglewise.ai/threats/cve-2026-110757-text-csv-xs-versions-before-1-65-for-perl-allow-record-splitting)
- [Text::CSV_XS quadratic CPU use with CR-only input](https://junglewise.ai/threats/cve-2026-110755-text-csv-xs-versions-before-1-65-for-perl-allow-quadratic-cpu)
- [Text::CSV_XS use-after-free in bind_columns with skip_empty_rows](https://junglewise.ai/threats/cve-2026-110753-text-csv-xs-versions-from-1-46-before-1-65-for-perl-have-a-use)