Executive brief
A security flaw exists in the Squirrel programming language, a lightweight scripting engine used in various software and games. A local attacker can exploit this vulnerability to cause a system crash or potentially execute unauthorized code by providing specially crafted input. This could lead to a disruption of service or unauthorized access to data on the affected system.
Technical details
A stack-based buffer overflow vulnerability exists in Squirrel up to version 3.2 within the 'validate_format' function of the 'sqstdlib/sqstdstring.cpp' library. The root cause is an off-by-one error during length checks when processing format strings. A local attacker with low privileges can trigger this overflow by passing a manipulated string to the affected function, potentially leading to arbitrary code execution or a denial of service. While a Proof-of-Concept (PoC) exploit has been published, the project maintainers have not yet released an official patch.
Affected products
- Squirrel Project Squirrel up to 3.2
Timeline
- 2026-05-11: disclosed: Vulnerability disclosed and CVE assigned
- 2026-05-11: advisory: VulDB and NVD published advisory