CVE-2026-110759: CWE-1286 Improper Validation of Syntactic Correctness of Input

The vulnerability in Text::CSV_XS before version 1.65 involves improper validation of syntactic correctness of input (CWE-1286). When parsing CSV input that ends with a separator and a lone carriage return (CR), the parser incorrectly inserts a 0xFF byte into the last field, which is not part of the original input. This leads to malformed UTF-8 strings if UTF-8 flagging is enabled. The problem arises because the parser treats the end-of-file marker as the next character in this specific scenario. This behavior can affect applications reading CRLF-terminated CSV files line by line, especially when the last column is empty.

Applications using vulnerable versions of Text::CSV_XS may receive unexpected 0xFF bytes in parsed fields when processing CSV inputs ending with a separator and a lone CR. This can cause malformed UTF-8 strings and potentially disrupt data processing or validation logic that expects clean input. The issue does not indicate direct code execution or privilege escalation but may lead to data integrity or parsing errors.

A fix is available in Text::CSV_XS version 1.65 and later. Users should upgrade to version 1.65 or newer to resolve this issue. No other mitigations are indicated or necessary according to the available data.