CVE-2026-110756

A flaw was found in Text::CSV_XS. When printing records where a UTF-8 flagged field precedes invalid UTF-8 bytes, the module drops held-back bytes, closing quotes, and line endings without signaling an error. An attacker capable of providing crafted input can exploit this flaw to cause data corruption, resulting in subsequent records being merged or misinterpreted by downstream parsers.

Red Hat has rated this vulnerability as having Moderate severity because it results in integrity loss through silent CSV output corruption without permitting arbitrary code execution or unauthorized information disclosure. In Red Hat Enterprise Linux, perl-Text-CSV_XS is utilized as a shared library by custom scripts and applications to export tabular data. The issue only manifests when an application handles malformed or non-standard character encodings in record fields, which can lead downstream parsers to misinterpret truncated entries or concatenated rows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.