CVE-2026-110759

Executive Summary

CVE-2026-110759 is a parsing correctness flaw in the Perl module Text::CSV_XS versions before 1.65. When parse processes input that ends in a field separator followed by a lone carriage return (CR), the parser treats end-of-input as the next character and writes the end-of-file marker (byte 0xFF) into the returned field. The bug is an integrity/encoding issue (CWE-1286: Improper Validation of Syntactic Correctness of Input) that causes applications to receive a byte that was not present in their input, potentially leading to malformed UTF-8 strings and downstream data corruption or validation bypass.

Technical Analysis

Text::CSV_XS is a widely deployed Perl library for parsing and generating CSV data. The vulnerability resides in its parsing state machine when handling a specific boundary condition: a lone CR at the end of input immediately following a separator, with an empty final field.

According to the NVD description, when input to parse ends in a separator and a lone CR, the parser treats the end of input as the next character and stores the end-of-file marker (the byte 0xFF) in the field. Concretely, with binary mode enabled, parse("a,\r") returns the fields "a" and "\xFF" — the 0xFF byte did not exist anywhere in the source input.

Two important behavioral notes from the advisory:

• Asymmetry with non-empty fields: The same input structure with a non-empty last field is rejected as an error. The defect is therefore specific to the empty-last-field path combined with a lone CR terminator.
• UTF-8 flagged input: On UTF-8 flagged input, the last field becomes a UTF-8 flagged string holding the lone 0xFF byte. Because 0xFF is never a legal UTF-8 sequence byte, this produces a string flagged as UTF-8 but containing malformed UTF-8 data — a violation of the string's encoding invariants that can cause subsequent decoding failures, corruption when re-serialized, or inconsistencies when the data is passed to other libraries.

Practical trigger path: A CRLF-formatted file read line by line and chomped ends in exactly this state when its last column is empty (the line ending becomes a lone CR after chomp removes the LF). This is a common ingestion pattern for CSV processing, so applications that read CRLF files line-by-line, chomp, and then call parse are the primary exposure class.

The root cause maps to CWE-1286 (Improper Validation of Syntactic Correctness of Input): the parser misclassifies the end-of-input condition as a buffer/field character rather than treating it as a terminator or error in this edge case. Full internal implementation details (the specific state or buffer variable involved) are not disclosed in the available description and are not asserted here.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. Because the flaw is a correctness/encoding defect rather than a memory-safety or injection primitive, the attack chain is inferred from the vulnerability class (input-structure manipulation leading to data integrity impact).

1. Reconnaissance / target identification: An adversary identifies an application that ingests CSV data using Text::CSV_XS (< 1.65) and processes rows. The most attractive targets are services accepting user-supplied CSV uploads or parsing CRLF-formatted files line-by-line where the final column can be left empty — for example importers, report generators, and ETL pipelines.

2. Triggering the flaw class: The attacker supplies input whose final record ends in a separator followed by a lone CR with an empty trailing field (the parse("a,\r") pattern). Due to the discrepancy between the attacker's input and the parser's output, the application receives a field containing 0xFF that the attacker did not literally include.

3. Payload / execution method (class-level): Because the injected byte (or malformed UTF-8 string) differs from what a naïve validator inspecting the raw input would expect, an attacker may attempt to exploit the mismatch between input inspection and parser output. Potential abuse patterns at the class level include evading input filters that do not anticipate 0xFF, provoking downstream decode/crash conditions in UTF-8 consumers, or causing data-integrity corruption in records. No specific exploit implementation is documented.

4. Post-exploitation impact: Inferred impact is limited to data integrity and possible denial-of-service via malformed UTF-8 handling in dependent code. There is no evidence of confidentiality or availability compromise beyond application-specific error handling.

Impact Assessment

The vulnerability results in an integrity defect: applications receive a byte not present in their input, and in UTF-8 contexts a string with invalid encoding. Business impact centers on:

• Data integrity: Corrupted or unexpected values stored or forwarded downstream, undermining trust in imported records.
• Application reliability: Malformed UTF-8 strings can trigger exceptions, logging anomalies, or failures in libraries that enforce encoding validity (potential limited availability impact).
• Validation bypass potential: Logic that validates raw input text but relies on parser output may make incorrect decisions.

Based on an inferred CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the primary impacted metric is Integrity (Low), with no direct Confidentiality or Availability impact. Blast radius is broad in terms of installed base — Text::CSV_XS is a foundational Perl module used across countless scripts and web backends — but per-instance impact is generally low and depends on how each application consumes parsed fields. The CVE is not listed in CISA KEV and has no EPSS score.

Detection Guidance

Sigma Rule

title: Text::CSV_XS 0xFF Injection via Lone CR Empty Field (CVE-2026-110759)
id: 5f2c9a71-3b8e-4d2a-9c1e-7a6b4f0d1e23
status: experimental
description: Detects Perl applications logging or emitting 0xFF byte artifacts from Text::CSV_XS parse of input ending in separator plus lone CR
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110759
author: valtersit.com
date: 2025/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_perl:
    type: 'EXECVE'
    a0|endswith: '/perl'
  selection_csv:
    a1|contains:
      - 'CSV_XS'
      - 'Text::CSV'
  condition: selection_perl and selection_csv
fields:
  - a0
  - a1
  - exe
falsepositives:
  - Legitimate Perl scripts importing CSV data
level: low
tags:
  - attack.t1190
  - cwe.cwe-1286

YARA Rule

rule CVE_2026_110759_CSVXS_LoneCR_Artifact
{
    meta:
        description = "Detects Text::CSV_XS version strings below 1.65 in Perl scripts and logs containing 0xFF field artifacts"
        cve = "CVE-2026-110759"
        author = "valtersit.com"
        date = "2025-01-01"
    strings:
        $csvxs = /Text::CSV_XS/ nocase
        $ver_old = /VERSION\s*=\s*['"]?1\.(?:[0-5][0-9]|6[0-4])['"]?/ nocase
        $parse_call = "parse(" nocase
        $cr_lone = /\x2c\x0d/  // ",\r" separator + lone CR pattern
    condition:
        (uint16(0) == 0x2321 or $csvxs) and
        ($ver_old and $parse_call) or ($cr_lone and $csvxs)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110759 Text::CSV_XS parse lone CR empty field attempt"; flow:established,to_server; content:"|2C 0D|"; http_client_body; fast_pattern; content:"|0A|"; http_client_body; pcre:"/,\r(?!\n)/"; reference:cve,2026-110759; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110759; classtype:attempted-recon; sid:2026110759; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("perl", "perl5") and
  process.args : "*CSV_XS*" and
  process.args : "*parse*"

Splunk SPL Query

index=linux_logs sourcetype=auditd OR sourcetype=syslog
| search "Text::CSV_XS" OR ("parse(" AND "CSV_XS")
| regex _raw=",\\x0d(?!\\x0a)"
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, user
| where count > 0

Wazuh OSSEC Rule

<group name="cve-2026-110759,perl,csv,">
  <rule id="2026110" level="3">
    <decoded_as>syslog</decoded_as>
    <match>Text::CSV_XS</match>
    <description>CVE-2026-110759: Text::CSV_XS CSV parsing event observed</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="2026111" level="6">
    <if_sid>2026110</if_sid>
    <regex type="pcre2">parse\("[^"]*,\r(?!\n)"</regex>
    <description>CVE-2026-110759: suspected lone CR + empty last field parse pattern (0xFF injection)</description>
    <group>data_integrity,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence was found from any tracked source, and NVD lists no vendor-confirmed fix. However, the description states the issue affects versions before 1.65, implying 1.65 is the fixed release.

1. Immediate mitigations:

   • Upgrade Text::CSV_XS to version 1.65 or later where feasible.
   • If upgrade is not possible, validate the exact character(s) preceding a lone CR before calling parse, and reject or normalize input that ends in a separator followed by a lone CR with an empty field.
   • Avoid relying on parser output alone for field content validation; cross-check against raw input.
   • Ensure downstream consumers can handle/reject byte 0xFF and malformed UTF-8 safely, and validate encoding at ingestion boundaries.

2. Patch/upgrade steps:

   • Use your Perl package manager to install Text::CSV_XS >= 1.65 (e.g., CPAN install or distro package upgrade), then verify the installed version.
   • Re-test any CRLF line-by-line chomp-then-parse workflows to confirm the empty-last-column case no longer yields 0xFF.

3. Long-term hardening:

   • Enforce strict encoding validation on CSV ingestion pipelines; treat parser output as untrusted.
   • Add unit tests covering edge cases: separator + lone CR, empty last fields, and UTF-8 flagged inputs.
   • Pin and monitor Perl module versions in dependency inventories; track advisories for Text::CSV_XS.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-110759
• CWE-1286: https://cwe.mitre.org/data/definitions/1286.html
• Text::CSV_XS CPAN documentation: https://metacpan.org/pod/Text::CSV_XS
• CISA KEV catalog (not listed for this CVE): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• No known threat actor campaigns or exploit-in-the-wild evidence is associated with CVE-2026-110759 at the time of writing.