CVE-2026-110753

{
  "etk_id": "ETK-2026-2311",
  "cve_id": "CVE-2026-110753",
  "display_id": "CVE-2026-110753",
  "ghsa_id": "GHSA-gvjh-vp76-v2mp",
  "euvd_id": "EUVD-2026-103193",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Use-after-free in Text::CSV_XS bound-column parsing",
  "summary": "Text::CSV_XS versions 1.46 through 1.64 can mishandle memory associated with bound columns when processing empty CSV rows. An attacker able to supply CSV input may cause an affected application to use released memory and crash, if it uses bind_columns with skip_empty_rows or the affected eof-mode handling.",
  "mitigation": "Upgrade Text::CSV_XS to version 1.65 or later. Until upgrades are complete, avoid processing empty rows with bind_columns and skip_empty_rows or the affected eof-mode handling.",
  "vendor": null,
  "product": "Text-CSV_XS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 1.46, < 1.65"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.65"
      ],
      "package_name": "Text-CSV_XS",
      "purl": null
    }
  ],
  "cwes": [
    416,
    911
  ],
  "cvss_score": 9.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 13.555709516666667,
  "t0_at": "2026-10-16T22:06:23.680000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-21T10:59:20.407422+00:00",
      "days": 4.53676767849537,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T22:06:23.680000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T22:06:23.680000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T22:06:23.680000+00:00",
      "url": "https://github.com/advisories/GHSA-gvjh-vp76-v2mp"
    }
  }
}