Text::CSV_XS EUVD-2026-26237

Requires the calling application to have registered at least one callback (after_parse, before_print, after_in, or on_error) on the Text::CSV_XS object AND that callback to extend the Perl argument stack enough to trigger a reallocation during Parse, print, getline, or getline_all; objects with no registered callbacks are explicitly not affected. Attack vector is local (AV:L) with no authentication (PR:N) and no user interaction, but exploitation is limited by this non-default callback configuration and by the need for attacker-controlled input to flow through the callback-enabled parsing path - making it dependent on application code structure rather than a default deployment.

Signals conflict and lean toward low real-world urgency despite the 8.4 base score. CVSS is AV:L/AC:L/PR:N/UI:N with C:H/I:H/A:H, but the description constrains exploitation to code paths where the application itself has registered callbacks that extend the argument stack - a non-default, developer-controlled condition not captured by AC:L. EPSS is 0.01% (3rd percentile), SSVC reports Exploitation:none and Automatable:no (only Technical Impact:total), and there is no KEV listing and no public exploit identified. The high C/I ratings appear optimistic: demonstrated impact is returning the wrong object and crashes (denial of service / logic errors), with type confusion as a theoretical escalation rather than proven code execution. Treat this as a correctness/stability defect for Perl applications using CSV callbacks rather than a broadly weaponizable RCE; note AV:L means it is not remotely reachable without attacker-influenced input flowing through a callback-enabled parser.

An attacker supplies crafted CSV input to a Perl application that parses it with Text::CSV_XS while a callback such as after_parse is registered; the callback grows the argument stack enough to force reallocation, so getline_all returns the parser object instead of the expected row data. The resulting type confusion or read of freed memory causes the application to crash or mishandle data (denial of service / logic corruption). No standalone weaponized exploit is public, but the fix commit includes a sandbox reproducer (sandbox/issue-65.pl) demonstrating the fault, and the local attack vector requires attacker-influenced input to reach the callback-enabled parse path.