The Text-CSV_XS Perl library before version 1.65 returns a 0xFF byte for an empty last field that is followed by a lone carriage return during parsing. When the binary flag is set, the parser returns this byte as a separate field, and when UTF-8 flagged input is used, the returned string contains malformed UTF‑8. The same input with a non‑empty last field is rejected as an error. As a result, the application receives a byte that was never present in the input string, potentially corrupting data or causing downstream processing errors.

Perl applications that use the CPAN library Text-CSV_XS prior to version 1.65 are affected. Versions 1.64 and earlier will return the 0xFF byte under the conditions described.

The vulnerability is local in scope and requires crafted input that ends in a separator followed by a lone carriage return. No remote code execution or privilege escalation is possible; the impact is limited to data integrity and malformed UTF‑8 handling. The CVSS score of 9.8 indicates a critical severity. The EPSS score is less than 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The primary risk is that parsing errors or downstream logic may misbehave because of the unexpected byte.