CVE-2026-110758: CWE-127 Buffer Under-read

The vulnerability in Text::CSV_XS (CVE-2026-110758) involves a buffer under-read (CWE-127) in versions prior to 1.65. When allow_whitespace is enabled, the strip_trail_whitespace function removes trailing spaces and tabs from unquoted fields but does not properly stop at the start of the field buffer. For fields composed entirely of blanks, this results in reading bytes before the allocated buffer. If these bytes are also whitespace characters, they may be zeroed out and the backward traversal continues depending on allocator behavior. This flaw can occur when an all-blank field follows a leading escape character different from the quote character or as a quoted field in getline when the line ends with two carriage returns.

The buffer under-read may lead to reading memory outside the intended buffer, which can cause undefined behavior such as data leakage or program instability. However, no known exploits are reported in the wild. The impact is limited to the internal parsing logic of Text::CSV_XS when processing specific CSV input patterns.

No official patch or fix information is provided in the available data. Users should upgrade to Text::CSV_XS version 1.65 or later once available, as versions before 1.65 are affected. Until a fix is confirmed, avoid processing CSV inputs that trigger the vulnerable code path, such as all-blank fields with leading escape characters or quoted fields ending with two carriage returns. Monitor the vendor or CPAN security advisories for updates.