Text-CSV_XS before 1.65 contains a bug in the strip_trail_whitespace routine that can read bytes before the start of an all‑blank field when allow_whitespace is enabled. This off‑by‑one read can expose or overwrite adjacent memory, potentially causing data corruption or a crash. The vulnerability does not expose a directly documented code‑execution path, but memory corruption can lead to severe local compromise if an attacker controls the input.

Perl modules Text‑CSV_XS versions 1.64 and earlier are affected. The bug arises when allow_whitespace is true and strip_trail_whitespace is used. Users of these legacy versions on any platform running Perl are at risk.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, so public exploitation data is limited. However, memory‑corruption bugs are generally considered high risk when an attacker can supply crafted CSV input. The likely attack vector is local or remote code execution through parsing of a malicious CSV file, depending on privileges. Because a CVSS score is not provided, the severity must be judged based on the potential for memory corruption and the ease of exploitation inferred from the description.