CVE-2026-110756

Executive Summary

CVE-2026-110756 is a data-integrity and output-encoding defect in the Perl module Text::CSV_XS (all versions before 1.65). When a CSV record contains a UTF-8-flagged field followed by invalid UTF-8 bytes, the module's print method silently drops the trailing byte, any closing quote, and the line ending while still returning a true (success) value. Any system using the affected library to generate CSV output — export pipelines, log serialization, report generation, data interchange between applications — can emit malformed or corrupted records. The consequence is downstream CSV parsing failures, record misalignment, or injection of attacker-influenced content into records that legitimate consumers treat as correctly quoted.

Technical Analysis

Text::CSV_XS is a widely used Perl module for parsing and serializing comma-separated values. Its print method converts a Perl array of fields into a CSV-formatted line. The vulnerability lies in the interaction between the module's UTF-8 buffering logic and genuinely invalid byte sequences.

The buffering behavior described in the NVD record is a deliberate correctness mechanism: when a field carries a UTF-8 flag, print may encounter a multibyte character that straddles a buffer boundary. To avoid splitting that character mid-sequence, the module holds back trailing bytes that do not currently form a valid UTF-8 character at each buffer flush. The intent is that the next flush completes the character. The defect is that after the record's final flush, no mechanism writes out the held-back bytes. Thus, if a record's last field terminates in a byte that is not part of a valid UTF-8 sequence, those bytes are discarded.

The silent nature of the failure is the most significant aspect. print returns true, meaning calling code has no indication that output was truncated. The record loses up to three classes of content at once: the trailing byte itself, a closing quote (if the field was quoted), and the line terminator. The NVD description notes two downstream outcomes:

1. If the field was unquoted, the next record is appended to the same physical line, merging two logical records.
2. If the field was quoted, the missing closing quote causes a reading CSV parser to treat every following record as continuation of that quoted field.

Both outcomes are record-corruption events. The second is arguably more dangerous because a single malformed record can swallow an arbitrary number of subsequent records into one giant field, structurally invalidating the remainder of the export. The description explicitly states that combine is not affected — only the print path is vulnerable.

CWE-116 (Improper Encoding or Escaping of Output) is the assigned classification. This is apt: the flaw is that the output encoder fails to correctly and completely encode the byte stream it is given, producing output that does not faithfully represent the intended data. No CVSS score or vector was assigned in the supplied data, so severity must be assessed qualitatively.

The attack surface is any code path that feeds attacker-influenced or untrusted data through Text::CSV_XS::print where a UTF-8-flagged field can end in invalid UTF-8 bytes. Applications that validate and normalize input to well-formed UTF-8 before serialization are not exposed. Applications that pass raw bytes, legacy-encoded data, or partially decoded input directly into a flagged field are exposed.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for this CVE at the time of writing. The following attack chain is inferred from the vulnerability class (output encoding defect leading to CSV record corruption) and the specific mechanism described in NVD.

1) Reconnaissance / target identification. An attacker identifies an application whose output is a CSV file or stream generated with Text::CSV_XS (for example, a report exporter, a data-dump endpoint, or an audit-log serializer) and determines whether user-controllable input flows into a field that the application marks as UTF-8. The attacker can probe by submitting values and examining whether export output reflects them and whether the application accepts non-UTF-8 byte sequences.

2) Triggering the flaw class. The attacker supplies input designed to place invalid UTF-8 bytes at the end of the last field of a record, where that field is flagged UTF-8. Because the final flush discards the held-back bytes, the generated record is truncated. The attacker does not need a specific function name or parameter — the trigger is simply the data content itself flowing into the export.

3) Execution / payload method at the vulnerability-class level. The payload is the malformed byte content. Depending on whether the affected field is quoted, the attacker achieves one of two structural results: record merging (next legitimate record joins the attacker's line) or record-swallowing (a missing closing quote causes the reader to absorb all subsequent records into one field). No code execution is involved; the effect is data-structure manipulation of the output artifact.

4) Post-exploitation impact. The attacker can corrupt exported data to hide or relocate entries, cause downstream automated parsers to misread or reject files, or — where the attacker controls only part of the data — cause trusted records to be attributed to the wrong columns or records. This is a data-integrity play, potentially useful for evading audit/log review, poisoning data feeds, or inducing denial of service in consumers that fail on malformed CSV. The exact business consequence depends entirely on how the receiving system trusts and ingests the CSV.

Given the absence of CVE-specific research, defenders should treat this as a correctness/integrity bug that becomes security-relevant where output is trusted as an accurate record of events or transactions.

Impact Assessment

The blast radius is determined by downstream trust in Text::CSV_XS-generated output rather than by the library itself. Affected systems include any Perl application, export service, or batch pipeline using the module before 1.65 to serialize records containing UTF-8-flagged fields populated with potentially invalid bytes.

Qualitative impact dimensions:

• Integrity (primary): Silent record truncation and merging directly violate data integrity. Because print returns true, upstream logic will not detect the failure without independent verification. Consumers may act on corrupted data believing it valid.
• Availability (secondary): Parsers that strictly validate CSV structure may reject entire files after encountering a swallowed record or missing quote, disrupting automated ingestion. This is a realistic denial-of-service vector for pipelines that fail-closed.
• Confidentiality: No direct confidentiality impact from the encoding defect itself; however, record-merging can misattribute data across records, complicating audit reconstruction.
• Scope: No privilege escalation or code execution. The defect is contained to output correctness.

A formal CVSS score was not published in the supplied data (reported as N/A). Estimating a numeric score here would require assumptions not supported by the provided evidence, so severity should be assessed per-deployment based on the consumer's sensitivity to malformed records. Systems that treat CSV exports as authoritative audit or financial records should rate this high on integrity grounds; systems that perform strict downstream validation and can tolerate rejection should rate it lower.

Detection Guidance

Detection must focus on both the vulnerable library version in use and the observable symptom: CSV exports containing records with truncated or missing line terminators, unclosed quotes, or merged records.

Sigma Rule

title: Text::CSV_XS Output Corruption - CSV Records Lacking Proper Line Termination
id: 8f3a2c1e-4b6d-4e2a-9c7f-5d1e2a3b6c90
status: experimental
description: Detects potential exploitation of CVE-2026-110756 where Text::CSV_XS (pre-1.65) emits malformed CSV records due to dropped trailing bytes and missing closing quotes or line endings.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110756
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_event
  product: linux
detection:
  selection_write:
    TargetFilename|endswith: '.csv'
  selection_process:
    Image|endswith:
      - '/perl'
      - '/perl5'
  condition: selection_write and selection_process
fields:
  - Image
  - TargetFilename
  - User
falsepositives:
  - Legitimate CSV generation with non-UTF8 legacy data
level: medium

Because the observable corruption manifests as malformed CSV content rather than a distinct log event, supplement this with application-level integrity checks that validate every emitted record ends with a proper CRLF/LF and that quote balance is even.

YARA Rule

rule CVE_2026_110756_Text_CSV_XS_Vulnerable_Version
{
    meta:
        description = "Detects Perl Text::CSV_XS source/version strings indicating a vulnerable version before 1.65"
        cve = "CVE-2026-110756"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110756"
    strings:
        $mod = "CSV_XS"
        $ver_old = /\\$VERSION\\s*=\\s*['\"]?1\\.(?:[0-5]?\\d|6[0-4])(?:\\.\\d+)?['\"]?/ ascii
    condition:
        $mod and $ver_old
}

Note: this rule flags source files declaring a $VERSION below 1.65 for the module. Adjust the string pattern to your packaging conventions (cpanfile, META.json, or installed .pm headers).

Suricata IDS Rule

CVE-2026-110756 is a local serialization defect and produces no distinctive network signature — there is no wire-protocol artifact unique to the flaw. A network IDS rule cannot reliably distinguish this corruption from legitimate malformed CSV in transit. If CSV files traverse the network (SFTP/HTTP file transfers), alerting on truncated CSV is better handled by content-inspection at the application tier. No meaningful Suricata signature is recommended; any rule here would generate unacceptably high false positives.

Elastic Detection

file where event.action in ("creation", "modification") and
  file.extension == "csv" and
  process.name in ("perl", "perl5") and
  file.path : "*.csv"

This identifies CSV files written by Perl processes for further integrity validation. Combine with an application-side assertion that emitted files end with a newline and have balanced quote counts; the EQL query itself only flags the write event and is a starting point for triage.

Splunk SPL Query

index=app sourcetype=csv_export OR sourcetype=csv_generator
| eval line_ok = if(len(_raw) > 0 AND (match(_raw, "\n$")), 1, 0)
| where line_ok = 0
| stats count by host, sourcetype, source

This surfaces CSV output events lacking a terminating newline, a common symptom of the dropped line ending described in the CVE. Tune sourcetype to your exporter. Because print returns true on failure, these records will not appear in application error logs and must be caught by output inspection.

Wazuh OSSEC Rule

<group name="cve_2026_110756,csv_integrity,">
  <rule id="202611075" level="7">
    <decoded_as>json</decoded_as>
    <field name="csv_module">Text::CSV_XS</field>
    <field name="csv_version">^1\.(?:[0-5]?\d|6[0-4])(?:\.\d+)?$</field>
    <description>CVE-2026-110756: Vulnerable Text::CSV_XS version detected (pre-1.65) - CSV output may be silently truncated.</description>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>
  <rule id="202611076" level="8">
    <decoded_as>json</decoded_as>
    <field name="csv_integrity">failed</field>
    <field name="csv_module">Text::CSV_XS</field>
    <description>CVE-2026-110756: CSV output integrity check failed (missing line ending or unbalanced quotes) - possible record corruption.</description>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>
</group>

These rules consume application telemetry that reports the in-use module version and results of output-integrity validation. Deploy a small post-export validator (checks terminating newline and quote balance) that writes JSON into Wazuh to drive these rules.

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence was found in any tracked source, and no vendor advisory URL, commit reference, or confirmation beyond the NVD "before 1.65" wording was provided. Treat remediation as relying on the version boundary stated in the description.

1) Immediate mitigations:

• Upgrade Text::CSV_XS to 1.65 or later immediately; the description fixes the affected range at versions before 1.65.
• Where upgrade is not immediately possible, ensure input to print is validated as well-formed UTF-8 before serialization (reject or sanitize invalid byte sequences), which removes the trigger condition of invalid UTF-8 bytes following a UTF-8-flagged field.
• Add post-generation integrity checks to all CSV outputs: verify each record ends with a proper line terminator and that quote counts are balanced; fail loudly rather than trusting the print return value.
• Avoid serializing raw or legacy-encoded bytes directly into UTF-8-flagged fields.

2) Patch / upgrade steps:

• Update via CPAN (cpanm Text::CSV_XS@1.65) or your distribution's packaging, whichever governs the deployment, and verify the installed $VERSION is >= 1.65.
• Rebuild and redeploy any vendored or containerized copies of the module; Perl modules are frequently bundled inside application images and are easy to miss.
• Re-run data-integrity validation against previously generated exports to estimate historical corruption.

3) Long-term hardening:

• Maintain a software bill of materials (SBOM) that includes Perl module versions so vulnerable library copies can be located quickly.
• Enforce input normalization to valid UTF-8 at trust boundaries feeding serialization pipelines.
• Treat all print-style serialization return values as necessary but not sufficient success indicators; verify output artifacts structurally.
• Monitor the module's changelog and track future releases for confirmation and any follow-up fixes tied to this CVE.

References

1. NVD — CVE-2026-110756: https://nvd.nist.gov/vuln/detail/CVE-2026-110756
2. CWE-116: Improper Encoding or Escaping of Output — https://cwe.mitre.org/data/definitions/116.html
3. Perl Text::CSV_XS module documentation (CPAN) — review the current release and changelog to confirm the 1.65 fix: https://metacpan.org/pod/Text::CSV_XS
4. MITRE ATT&CK T1005 — Data from Local System: https://attack.mitre.org/techniques/T1005/

No threat-actor campaign, in-the-wild exploitation, CISA KEV listing, or public exploit code is associated with this CVE based on the supplied data. FIRST.org has not assigned an EPSS score. Severity should be assessed per-deployment on integrity grounds pending any vendor advisory or CVSS publication.