The likely attack vector is an attacker crafting a CSV file that includes empty lines processed with bind_columns and skip_empty_rows, thereby invoking the use‑after‑free in Text::CSV_XS. The vulnerability frees a scalar variable bound to the caller. When skip_empty_rows skips an empty line, the parser deletes the bound scalar without verifying that it remains in use. The application later accesses this freed memory, causing a process crash.

Perl modules using Text::CSV_XS version 1.46 through 1.64, inclusive, on CPAN. These versions are incompatible with any Perl program that employs bind_columns together with skip_empty_rows or enables eof mode on empty lines.

The CVSS score of 9.8 indicates critical severity. Because the flaw is triggered by specific input handling and requires bind_columns, the risk is primarily local and results in a denial‑of‑service via crash. The likely attack vector involves an attacker supplying crafted CSV input that contains empty lines processed with bind_columns, causing the use‑after‑free. The EPSS score of < 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet become a widely exploited threat. Nonetheless, any environment that processes CSV input with this module should treat it as a high‑risk issue until patched.