Text::CSV_XS versions before 1.62 for Perl have a use-after-free when registered callbacks extend the Perl argument stack, which may enable type confusion or memory corruption.
CVSS 3.1HIGH 8.4·Local·No auth·No interaction·EPSS 0.00158·Published 2026-04-29·Fixed in 1.62CWE-416