CVE-2026-110756: CWE-116 Improper Encoding or Escaping of Output

In Text::CSV_XS versions prior to 1.65, when printing a record containing a UTF-8 flagged field followed by invalid UTF-8 bytes, the print function holds back trailing invalid UTF-8 bytes at each buffer flush to complete split characters. However, after the final flush of the record, these held-back bytes are never written out. This leads to loss of the last byte of the field, the closing quote, and the line ending. Consequently, the next record is written on the same line or, if the last field was quoted, the missing closing quote causes the CSV reader to treat all subsequent records as part of that field. The combine method is not affected by this issue.

The vulnerability causes corruption of CSV output by dropping the end of records and line endings when invalid UTF-8 bytes are present in UTF-8 flagged fields. This can lead to malformed CSV files where records are concatenated incorrectly, potentially causing data parsing errors or misinterpretation of CSV data downstream. There is no indication of code execution or data leakage.

No official patch or fix is currently documented. Users should avoid using Text::CSV_XS versions before 1.65 with UTF-8 flagged fields containing invalid UTF-8 bytes in print operations. Monitor the vendor or CPAN security advisories for updates or patches addressing this issue. Until a fix is available, validate and sanitize UTF-8 input data to prevent invalid byte sequences.