A use-after-free vulnerability in the Text::CSV_XS library for Perl, rated 8.4 High, could allow for memory corruption and logic errors if callbacks trigger stack reallocations.

The library suffers from a use-after-free condition when registered callbacks extend the Perl argument stack. This causes methods to cache a stale stack pointer, which is then used to write data into a freed buffer or return unexpected object types to the calling application.

Successful exploitation of this vulnerability can lead to memory corruption, crashes, or severe logic errors within applications utilizing the library. Given the CVSS score of 8.4, the risk is significant because an attacker may influence application state or cause denial of service. While exploitation requires specific callback configurations, the potential for arbitrary memory manipulation warrants immediate attention to prevent unauthorized data handling or system instability.

Immediate Action: Upgrade to Text::CSV_XS version 1.62 or later immediately to resolve the memory management flaw.

Proactive Monitoring: Monitor application logs for unexpected crashes or error messages occurring during CSV parsing or printing operations, especially in modules that utilize custom callbacks.

Compensating Controls: Audit codebases to identify if registered callbacks (such as after_parse, before_print, or on_error) are in use, and consider disabling these features temporarily if an immediate update is not feasible.

Public Exploit Available: Unknown

The vulnerability presents a high risk to applications relying on Text::CSV_XS for data processing. Administrators should prioritize updating the library to version 1.62 across all environments to eliminate the risk of memory corruption. If immediate patching is not possible, review application code to determine if registered callbacks are present, as these are the primary vector for triggering the use-after-free condition.