Executive brief
Squirrel is a high-level imperative, object-oriented programming language designed to be lightweight for use in applications like video games. A vulnerability in how the language handles compiled bytecode files allows a specially crafted file to crash the application or potentially execute unauthorized code. This risk is present when an application using Squirrel loads untrusted script files from a local source.
Technical details
A heap-based buffer overflow exists in Squirrel up to version 3.2 within the SQFunctionProto::Load function in squirrel/sqobject.cpp. The vulnerability is caused by an integer overflow in the _FUNC_SIZE macro when calculating memory allocation sizes for bytecode components (specifically nlineinfos and ndefaultparams). On 64-bit systems, crafted values in a .cnut bytecode file can cause the macro to wrap, resulting in a small memory allocation. Subsequent calls to SafeRead then perform a large write into this undersized buffer. An attacker can trigger this by providing a malicious bytecode file to any application using sqstd_loadfile or sq_readclosure. As of the advisory date, the project has not yet released a formal patch.
Affected products
- Squirrel Project Squirrel up to 3.2
Timeline
- 2026-04-22: disclosed: Issue reported on GitHub with PoC
- 2026-05-11: advisory: NVD publication date