The Text::CSV_XS Perl module, before version 1.65, contains a flaw in its print routine that deletes trailing bytes that are not valid UTF‑8 when a UTF‑8 flagged field precedes such bytes. As a consequence, the end of the last field, the closing delimiter, and the line ending are omitted from the record while the function still reports success. The missing quotation mark can cause an entire subsequent record to be parsed as part of that field, leading to concatenated or corrupted CSV data. This behavior maps to CWE‑116 (Improper Encoding/Decoding) and CWE‑135 (Improper Handling of Exceptional Conditions).

Any application built with Perl that imports or exports CSV files using Text::CSV_XS version 1.64 or earlier is affected. The issue is present regardless of operating system or Perl distribution, as long as the old module is installed from CPAN or similar repositories.

The vulnerability does not provide remote code execution or privilege escalation; it mainly causes loss or corruption of CSV data. The likely attack vector involves local or trusted users feeding crafted CSV input processed by the vulnerable module, making the exploitation scenario limited to environments where such input is handled. The CVSS score of 9.8 indicates high severity. The EPSS score of < 1% and the fact that the vulnerability is not listed in the CISA KEV catalog suggest a low likelihood of widespread exploitation. Nonetheless, systems depending on accurate CSV data should treat this as an integrity risk and address it promptly.