CVE-2026-7111

{
  "id": "CVE-2026-7111",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-04-29T15:16:09.183",
  "lastModified": "2026-10-26T20:10:00.160",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.\n\nThe Parse, print, getline, and getline_all methods invoke registered callbacks (for example after_parse, before_print, or on_error) and cache the Perl argument stack pointer across the call. If a callback extends the argument stack enough to trigger a reallocation, the return value is written through the stale pointer into the freed buffer, and the caller reads the original $self argument as the return value instead.\n\nCalling code that expects parsed data from getline_all receives the Text::CSV_XS object in its place, leading to logic errors or crashes. Text::CSV_XS objects used without any registered callbacks are not affected."
    },
    {
      "lang": "es",
      "value": "Las versiones de Text::CSV_XS anteriores a la 1.62 para Perl tienen un uso después de liberación cuando las devoluciones de llamada registradas extienden la pila de argumentos de Perl, lo que puede permitir confusión de tipos o corrupción de memoria.\n\nLos métodos Parse, print, getline y getline_all invocan devoluciones de llamada registradas (por ejemplo, after_parse, before_print o on_error) y almacenan en caché el puntero de la pila de argumentos de Perl durante la llamada. Si una devolución de llamada extiende la pila de argumentos lo suficiente como para activar una reasignación, el valor de retorno se escribe a través del puntero obsoleto en el búfer liberado, y el llamador lee el argumento $self original como el valor de retorno en su lugar.\n\nEl código que llama y espera datos analizados de getline_all recibe el objeto Text::CSV_XS en su lugar, lo que lleva a errores de lógica o fallos. Los objetos Text::CSV_XS utilizados sin ninguna devolución de llamada registrada no se ven afectados."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "HMBRAND",
          "product": "Text::CSV_XS",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Text-CSV_XS",
          "programFiles": [
            "CSV_XS.xs"
          ],
          "programRoutines": [
            {
              "name": "Text::CSV_XS::Parse"
            },
            {
              "name": "Text::CSV_XS::print"
            },
            {
              "name": "Text::CSV_XS::getline"
            },
            {
              "name": "Text::CSV_XS::getline_all"
            }
          ],
          "repo": "https://github.com/cpan-authors/Text-CSV_XS",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.62",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-29T17:49:05.158465Z",
          "id": "CVE-2026-7111",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        },
        {
          "lang": "en",
          "value": "CWE-825"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:hmbrand:text\\:\\:csv_xs:*:*:*:*:*:perl:*:*",
              "versionEndExcluding": "1.62",
              "matchCriteriaId": "42D9FCD4-72E4-4E7D-B842-1DF319D08DF0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Mailing List",
        "Patch"
      ]
    },
    {
      "url": "https://metacpan.org/release/HMBRAND/Text-CSV_XS-1.62/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/04/29/17",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00037.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}