Squirrel sqobject.h operator heap-based overflow
Priority MEDIUM 55CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00265 18th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Squirrel | 3.0; 3.1; 3.2 | — | No fix listed | CNA |
- Squirrel Vendor— Affected 3.0; 3.1; 3.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:squirrel-lang:squirrel:*:*:*:*:*:*:*:* | up to 3.2 | Vulnerable | Squirrel-lang |
- cpe:2.3:a:squirrel-lang:squirrel:*:*:*:*:*:*:*:* Versions up to 3.2 Vulnerable ·Squirrel-lang
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2661
- 2026-10-03 Alias added: GHSA-pppv-pc54-6j8r
References
More Squirrel-lang Squirrel vulnerabilities
- TI-2021-18293 sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read… CVSS 3.1CRITICAL 10.0
- TI-2026-08383 Squirrel Cnut File sqobject.cpp ReadObject heap-based overflow CVSS 4.0MEDIUM 4.8
- TI-2026-02925 Squirrel sqstdrex.cpp sqstd_rex_newnode null pointer dereference CVSS 4.0MEDIUM 4.8
- TI-2026-02924 Squirrel sqcompiler.cpp UnaryOP recursion CVSS 4.0MEDIUM 4.8
- TI-2026-02271 Squirrel sqfuncstate.cpp PopTarget out-of-bounds CVSS 4.0MEDIUM 4.8
- TI-2022-12528 Heap-based buffer overflow in sqbaselib.cpp in SQUIRREL 3.2 due to lack of a certain sq_reservestack call. CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-2661 · CVE Program
- CVE-2026-2661 · NVD
- FIRST EPSS
- GHSA-pppv-pc54-6j8r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences