CVE-2026-110758

Executive Summary

CVE-2026-110758 is a heap out-of-bounds read and potential memory corruption flaw in the Perl module Text::CSV_XS versions prior to 1.65. When parsing CSV data with the allow_whitespace and strip_trail_whitespace options enabled, an all-blank field can cause the parser to read (and potentially zero) a byte preceding the field's heap buffer. Any Perl application that processes attacker-supplied CSV through affected versions is exposed to denial-of-service or subtle data-integrity issues, though no public exploit or in-the-wild activity has been observed.

Technical Analysis

Text::CSV_XS is a widely used XS (C) implementation of CSV parsing for Perl, frequently embedded in data-ingestion pipelines, ETL jobs, and web applications that accept uploaded spreadsheets or delimited text. The vulnerability resides in the field-trailing-whitespace handling logic active when both allow_whitespace and strip_trail_whitespace are enabled.

Under normal operation, leading blanks in an unquoted field are skipped before the field buffer is allocated and stored, so a field consisting solely of blanks is not expected to reach the whitespace-stripping routine. The NVD description identifies two documented paths by which an all-blank field still arrives:

1. A field following a leading escape_char that differs from quote_char, and
2. A quoted field in getline when its line ends in two consecutive CR (\r\r) characters.

When such a field reaches the stripping logic, the code removes trailing spaces and tabs without stopping at the start of the field buffer. For a wholly blank field, the loop reads the byte immediately preceding the heap allocation. Depending on what the memory allocator placed there, that byte may itself be a space or tab; if so, it may be zeroed and the backward walk continues, corrupting adjacent heap metadata or data.

The weakness is classified CWE-127 (Buffer Under-read). It is a memory-safety issue in native code, so the practical impact depends heavily on the allocator state and the application's surrounding memory layout. No public proof-of-concept or exploit code is available, and no CVSS score has been assigned by NVD at the time of this report.

Exploitation Scenarios

No public PoC exists; the attack chain below is inferred at the vulnerability-class level from the NVD description.

1. Reconnaissance/target identification. An attacker identifies a service or workflow that ingests attacker-controlled CSV—for example, a file-upload endpoint, batch import job, or API that accepts delimited text—running on Perl with Text::CSV_XS < 1.65 and allow_whitespace/strip_trail_whitespace enabled.

2. Triggering the flaw. The attacker crafts a CSV input that causes an all-blank field to reach the strip routine, using one of the two documented paths: placing a leading escape_char (distinct from quote_char) before an all-blank field, or terminating a line containing a quoted field with two CR characters so the quoted field is all blanks at parse time.

3. Execution/corruption. The parser walks backward past the start of the field buffer, reading (and conditionally zeroing) the byte preceding the allocation. Where that byte is a space or tab, the walk may proceed further, corrupting adjacent heap data. The precise effect is allocator-dependent.

4. Post-exploitation impact. Realistic outcomes are parser crashes (denial of service) or corrupted/inaccurate parsed output that flows downstream into data stores or business logic. Memory corruption escalation cannot be ruled out but is unproven and speculative given available detail.

Impact Assessment

The blast radius is limited to applications actively using the affected options on untrusted input, but Text::CSV_XS is ubiquitous in Perl data processing, so many ingestion pipelines may qualify. Impact is primarily availability (crash/DoS) and potential integrity of parsed datasets; confidentiality impact is unlikely to be material. With no assigned CVSS score, risk scoring should be handled internally; a heuristic vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L reflects network-reachable inputs, high complexity due to allocator dependence, and no privilege requirement. No CISA KEV listing and no EPSS score are available.

Detection Guidance

Sigma Rule

title: Text::CSV_XS Heap Under-read via All-Blank Field (CVE-2026-110758)
id: 5f3a9c12-7b2e-4d1a-9c8e-110758ab0001
status: experimental
description: Detects Perl processes crashing or erroring while parsing CSV with allow_whitespace and strip_trail_whitespace on suspicious input
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    Image|endswith: '/perl'
  selection_args:
    CommandLine|contains:
      - 'CSV_XS'
      - 'allow_whitespace'
      - 'strip_trail_whitespace'
  condition: selection_cmd and selection_args
falsepositives:
  - Legitimate batch CSV import jobs using these options
level: medium
tags:
  - attack.t1190
  - cve.2026.110758

YARA Rule

rule Text_CSV_XS_Blank_Field_Underread_CVE_2026_110758
{
    meta:
        description = "Detects CSV_XS usage patterns referencing allow_whitespace/strip_trail_whitespace and CRCR line endings"
        cve = "CVE-2026-110758"
        author = "valtersit.com threat intel"
        severity = "medium"
    strings:
        $opt1 = "strip_trail_whitespace" ascii wide
        $opt2 = "allow_whitespace" ascii wide
        $crcr = "\r\r" ascii
    condition:
        any of ($opt*) and #crcr > 0
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110758 Text::CSV_XS all-blank field parse attempt"; flow:to_server,established; content:"allow_whitespace"; http_client_body; nocase; content:"strip_trail_whitespace"; http_client_body; nocase; reference:cve,2026-110758; classtype:attempted-dos; sid:2026110758; rev:1;)

Elastic Detection

process where event.type == "start" and process.name : "perl*" and
  process.args : ("*CSV_XS*", "*allow_whitespace*", "*strip_trail_whitespace*")

Splunk SPL Query

index=endpoint (process_name=perl OR process_image="*/perl*")
| search command_line="*allow_whitespace*" OR command_line="*strip_trail_whitespace*" OR command_line="*CSV_XS*"
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, command_line
| where count > 0

Wazuh OSSEC Rule

<group name="ossec,cve-2026-110758,">
  <rule id="110758" level="6">
    <if_sid>592</if_sid>
    <match>Text::CSV_XS|allow_whitespace|strip_trail_whitespace|CSV_XS</match>
    <description>CVE-2026-110758: Suspicious Text::CSV_XS parsing activity detected</description>
    <mitre><id>T1190</id></mitre>
    <group>attack.t1190,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Disable allow_whitespace and/or strip_trail_whitespace where business logic permits; validate and sanitize CSV uploads to reject all-blank unquoted fields, mismatched escape_char/quote_char sequences before blank fields, and lines ending in double CR. Run parsers in constrained, monitored subprocesses to contain crashes, and quarantine untrusted uploads.
2. Patch/upgrade steps. Upgrade Text::CSV_XS to 1.65 or later via CPAN (cpanm Text::CSV_XS@1.65 or higher), then rebuild/restart dependent applications. Confirm loaded version via perl -MText::CSV_XS -e 'print $Text::CSV_XS::VERSION'. No vendor patch is yet confirmed—validate against upstream releases before relying on this step.
3. Long-term hardening. Pin and audit third-party module versions in dependency manifests; add CSV fuzzing to CI for ingestion components; adopt memory-safe HTML parsing alternatives or strict schemas where feasible; monitor advisories for the module upstream.

References

• NVD — CVE-2026-110758: https://nvd.nist.gov/vuln/detail/CVE-2026-110758
• CWE-127 (Buffer Under-read): https://cwe.mitre.org/data/definitions/127.html
• CPAN Text::CSV_XS distribution: https://metacpan.org/dist/Text-CSV_XS
• CISA KEV Catalog (not listed as of report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild evidence identified for this CVE at time of writing.