# CVE-2026-110759: Text::CSV_XS incorrect byte returned for empty field with trailing CR

Source: https://junglewise.ai/threats/cve-2026-110759-text-csv-xs-versions-before-1-65-for-perl-return-a-0xff-byte  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110759 · Severity: info · Published 2026-10-16

Text::CSV_XS is a Perl library that parses CSV (comma-separated values) data. When parsing CSV text that ends with a separator followed by a carriage return (CR), the library incorrectly inserts a 0xFF byte into the parsed output that was not in the original input. This can cause applications to receive corrupted data, particularly in UTF-8 contexts where the byte represents malformed encoding.

Technologies: [CPAN Text::CSV XS](https://junglewise.ai/threats/technologies/cpan-text-csv-xs). Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-110759 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110759 being exploited in the wild.

**How severe is CVE-2026-110759?** Informational severity, published 16 October 2026.

**Which products and versions are affected?** CPAN Text::CSV XS before 1.65.

**Is there a fix for CVE-2026-110759?** Yes: fixed in 1.65. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110759 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-110759?** Check whether you run CPAN Text::CSV XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.65

## Technical details

The vulnerability occurs in the parse() method when input ends with a separator and a lone CR character. The parser incorrectly treats the end-of-file marker as a data byte (0xFF) instead of reporting an error as it does for non-empty final fields. This affects binary mode and UTF-8 flagged input differently: binary mode returns the literal 0xFF byte, while UTF-8 mode returns a malformed UTF-8 string containing that byte. The fix (version 1.65) adds validation in parse()-only mode to report error 2032 for trailing lone CR, matching the behavior of non-empty fields and preventing EOF from being stored as data.

## Affected products

- CPAN Text::CSV_XS before 1.65

## Timeline

- 2026-10-16: disclosed
- 2026-10-14: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/cpan-authors/Text-CSV_XS/commit/7627f1a2bb8ffe4e81d9847318a060822043f7f3.patch](https://github.com/cpan-authors/Text-CSV_XS/commit/7627f1a2bb8ffe4e81d9847318a060822043f7f3.patch)

## Related threats

- [Text::CSV_XS buffer over-read in strip_trail_whitespace](https://junglewise.ai/threats/cve-2026-110758-text-csv-xs-versions-before-1-65-for-perl-read-before-the-start)
- [Text::CSV_XS record splitting via unquoted numeric strings](https://junglewise.ai/threats/cve-2026-110757-text-csv-xs-versions-before-1-65-for-perl-allow-record-splitting)
- [Text::CSV_XS data corruption in print with UTF-8 and invalid bytes](https://junglewise.ai/threats/cve-2026-110756-text-csv-xs-versions-before-1-65-for-perl-drop-the-end-of-a)
- [Text::CSV_XS quadratic CPU use with CR-only input](https://junglewise.ai/threats/cve-2026-110755-text-csv-xs-versions-before-1-65-for-perl-allow-quadratic-cpu)
- [Text::CSV_XS use-after-free in bind_columns with skip_empty_rows](https://junglewise.ai/threats/cve-2026-110753-text-csv-xs-versions-from-1-46-before-1-65-for-perl-have-a-use)