What array? The output is being printed, as it was in your code. If you wish to place the output in an array instead of printing it, place the output in an array instead of printing it.

Sorry, I meant that after this line of code:

my ($cve_id, $summary) = @$row;

These variables appear to be empty, so there is no output.

Here's the code with some fixed typos and with error checking.

#!/usr/bin/perl -w

use strict;

use Text::CSV_XS qw( );

@ARGV == 1
   or die("usage: $0 id\n");

my ($query_id) = @ARGV;

my $csv = Text::CSV_XS->new();

my $query_cve_id;
{
   my $map_qfn = 'vuln_cve_map.csv';
   open(my $map_fh, '<', $map_qfn)
      or die("Can't open mapping file \"$map_qfn\": $!\n");

   while (my $row = $csv->getline($map_fh)) {
      my ($id, $cve_id) = @$row;
      if ($id == $query_id) {
         $query_cve_id = $cve_id;
         last;
      }
   }

   if ($csv->error_diag()) {
      die("Can't parse mapping file: ", $csv->error_diag(), "\n");
   }
}

{
   my $summary_qfn = 'CVE_summary.csv';
   open(my $summary_fh, '<', $summary_qfn)
      or die("Can't open CVE Summary file \"$summary_qfn\": $!\n");

   while (my $row = $csv->getline($summary_fh)) {
      my ($cve_id, $summary) = @$row;
      if ($cve_id == $query_cve_id) {
         print("[$cve_id] $summary\n");
         last;
      }
   }

   if ($csv->error_diag()) {
      die("Can't parse CVE Summary file: ", $csv->error_diag(), "\n");
   }
}
[download]

Running it yields

Can't parse CVE Summary file: 2021EIQ - NL char inside quotes, binary 
+off58
[download]

Your data is bad.

"CVE-1999-0095","The debug command in Sendmail is enabled
                                                         ^
                                                         |
                                                      missing
                                                      closing
                                                       quote
[download]