Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110758— Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace

Quick assessment

Affected
CVE-2026-110758
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 环境中，Text::CSV_XS 1.65 之前的版本存在漏洞：当启用 选项时， 功能会在处理全空白字段时，从该字段的起始位置之前读取数据。 具体而言，在 模式下， 会从每个未加引号的字段末尾移除尾随空格和制表符，但不会在字段起始处停止。若某字段仅由空白字符组成，该函数将读取该字段堆缓冲区起始位置之前的一个字节。如果该字节也是空格或制表符，则可能被清零，且遍历过程可能继续向后回溯，具体行为取决于内存分配器在该位置放置的内容。 通常情况下，字段存储前会跳过前导空白；但全空白字段仍可能在以下两种情形下出现

AI Predicted 8.1 Difficulty: Moderate EPSS 0.19% · P8

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 1.65 affected

I. Basic Information for CVE-2026-110758

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace
Source: CVE Program / CVE List V5
Vulnerability Description
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there. Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
缓冲区下溢读取
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.65 -

II. Public POCs for CVE-2026-110758

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110758

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110758 (1)

Other References for CVE-2026-110758 (1)

IV. Related Vulnerabilities

Same weakness: CWE-127

V. Comments for CVE-2026-110758

No comments yet

Leave a comment