Technical impact
Text::CSV_XS modules earlier than 1.62 contain a use‑after‑free flaw that occurs when a user‑registered callback enlarges the Perl argument stack and triggers a reallocation. The library keeps a stale pointer to the original stack, and after the callback returns, it writes the return value through this deprecated pointer into freed memory. This corruption can manifest as malformed return values, logic errors, or crashes. The mention of type confusion in the advisory indicates that the corrupted memory may affect data type handling within the interpreter, which could worsen the impact.
Affected Systems
All installations of HMBRAND:Text::CSV_XS with a version number less than 1.62 are affected. The vulnerability exists only when scripts register callbacks such as after_parse, before_print, or on_error; use of the module without callbacks leaves it safe. The module is a Perl library for CSV parsing distributed under the CPAN distribution name Text::CSV_XS.
Risk and Exploitability
Because the flaw requires an attacker to influence the script to register callbacks and craft input that expands the stack, the attack surface is constrained to applications that use callbacks and have sufficient privileges. The CVSS score of 8.4 indicates a high severity, but the EPSS metric is not provided, so the likely exploitation probability cannot be quantified from the available data. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. Nonetheless, memory corruption in a core interpreter component could potentially result in crashes or logic errors when legacy versions are used, but the CVE description does not declare arbitrary code execution.
Debian DLA