# CVE-2026-110758: Text::CSV_XS buffer over-read in strip_trail_whitespace

Source: https://junglewise.ai/threats/cve-2026-110758-text-csv-xs-versions-before-1-65-for-perl-read-before-the-start  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110758 · Severity: info · Published 2026-10-16

Text::CSV_XS is a Perl library that parses CSV data. When allow_whitespace is enabled, a code path that removes trailing spaces from fields can read memory before the field's allocated buffer if the field contains only whitespace, potentially exposing heap data or causing a crash.

Technologies: [CPAN Text::CSV XS](https://junglewise.ai/threats/technologies/cpan-text-csv-xs). Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-110758 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110758 being exploited in the wild.

**How severe is CVE-2026-110758?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** CPAN Text::CSV XS before 1.65.

**Is there a fix for CVE-2026-110758?** Yes: fixed in 1.65. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110758 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-110758?** Check whether you run CPAN Text::CSV XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.65

## Technical details

The cx_strip_trail_whitespace() function walks backwards through a field decrementing length without checking if it has reached the field's start, causing an out-of-bounds read when processing all-blank unquoted fields under allow_whitespace. This occurs when an all-blank field arrives after an escape_char that differs from quote_char, or via CR CR line ending auto-detection. The fix adds a length check before dereferencing s[len-1].

## Affected products

- CPAN Text::CSV_XS before 1.65

## Timeline

- 2026-10-16: disclosed
- 2026-10-14: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/cpan-authors/Text-CSV_XS/commit/efed7ee21177c59a5b69e787f84154e1fcb0d095.patch](https://github.com/cpan-authors/Text-CSV_XS/commit/efed7ee21177c59a5b69e787f84154e1fcb0d095.patch)

## Related threats

- [Text::CSV_XS incorrect byte returned for empty field with trailing CR](https://junglewise.ai/threats/cve-2026-110759-text-csv-xs-versions-before-1-65-for-perl-return-a-0xff-byte)
- [Text::CSV_XS record splitting via unquoted numeric strings](https://junglewise.ai/threats/cve-2026-110757-text-csv-xs-versions-before-1-65-for-perl-allow-record-splitting)
- [Text::CSV_XS data corruption in print with UTF-8 and invalid bytes](https://junglewise.ai/threats/cve-2026-110756-text-csv-xs-versions-before-1-65-for-perl-drop-the-end-of-a)
- [Text::CSV_XS quadratic CPU use with CR-only input](https://junglewise.ai/threats/cve-2026-110755-text-csv-xs-versions-before-1-65-for-perl-allow-quadratic-cpu)
- [Text::CSV_XS use-after-free in bind_columns with skip_empty_rows](https://junglewise.ai/threats/cve-2026-110753-text-csv-xs-versions-from-1-46-before-1-65-for-perl-have-a-use)