Executive brief
Squirrel is a lightweight programming language often embedded in applications and games. A security flaw in how it handles compiled bytecode files allows a local attacker to trigger a memory corruption error. This could potentially lead to a program crash or unauthorized code execution on the affected system.
Technical details
A heap-based buffer overflow exists in the ReadObject function within squirrel/sqobject.cpp of the Squirrel language (up to version 3.2). The vulnerability is caused by improper validation of string lengths read from a bytecode stream. Specifically, the ReadObject function accepts a signed SQInteger for string length without checking for negative values. When a negative length is provided, the GetScratchPad function fails to resize the buffer, but the subsequent SafeRead call passes the negative value to fread. Because fread interprets the signed integer as a large unsigned size_t, it performs an out-of-bounds write to the heap. This can be triggered by loading a malicious .cnut bytecode file via sqstd_loadfile or sq_readclosure.
Affected products
- Alberto Demichelis Squirrel Up to 3.2
Timeline
- 2026-04-22: disclosed: Issue reported to the project maintainer on GitHub
- 2026-05-26: advisory: CVE published by VulDB/NVD