CVE-2026-7111: CWE-825 Expired Pointer Dereference in HMBRAND Text::CSV_XS
Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption. The Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead. Calling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.
AI Analysis
Technical Summary
Text::CSV_XS before version 1.62 contains a use-after-free vulnerability triggered by registered callbacks that extend the Perl argument stack during invocation of methods like parse, print, getline, and getline_all. The module caches a pointer to the Perl argument stack, which becomes stale if the stack is reallocated due to callback activity. Consequently, the return value is written through this stale pointer into freed memory, causing the caller to receive the original Text::CSV_XS object instead of parsed data. This can cause logic errors or crashes. The vulnerability does not affect usage without registered callbacks.
Potential Impact
Affected applications using Text::CSV_XS with registered callbacks may experience logic errors or crashes due to corrupted return values from parsing methods. This can disrupt normal operation and potentially lead to memory corruption. There is no evidence of known exploits in the wild. The impact is limited to scenarios where callbacks extend the Perl argument stack.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using registered callbacks that extend the Perl argument stack with Text::CSV_XS or upgrade to version 1.62 or later if available. If no callbacks are used, this vulnerability does not apply.
CVE-2026-7111: CWE-825 Expired Pointer Dereference in HMBRAND Text::CSV_XS
Description
Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption. The Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead. Calling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected.
CVSS v3.1
Score 8.4high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Text::CSV_XS before version 1.62 contains a use-after-free vulnerability triggered by registered callbacks that extend the Perl argument stack during invocation of methods like parse, print, getline, and getline_all. The module caches a pointer to the Perl argument stack, which becomes stale if the stack is reallocated due to callback activity. Consequently, the return value is written through this stale pointer into freed memory, causing the caller to receive the original Text::CSV_XS object instead of parsed data. This can cause logic errors or crashes. The vulnerability does not affect usage without registered callbacks.
Potential Impact
Affected applications using Text::CSV_XS with registered callbacks may experience logic errors or crashes due to corrupted return values from parsing methods. This can disrupt normal operation and potentially lead to memory corruption. There is no evidence of known exploits in the wild. The impact is limited to scenarios where callbacks extend the Perl argument stack.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using registered callbacks that extend the Perl argument stack with Text::CSV_XS or upgrade to version 1.62 or later if available. If no callbacks are used, this vulnerability does not apply.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-04-26T15:31:25.111Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f2370ccbff5d8610306485
Added to database: 4/29/2026, 4:51:24 PM
Last enriched: 4/29/2026, 5:06:22 PM
Last updated: 6/13/2026, 8:04:20 AM
Views: 87
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.