CVE-2026-8261
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A heap-based buffer overflow vulnerability was found in Squirrel up to version 3.2 in the SQFunctionProto::Load function in squirrel/sqobject.cpp. The attack requires local access and is publicly disclosed, but the project has not responded.
Risk Assessment
A local attacker could exploit this vulnerability to cause a heap buffer overflow, potentially leading to a crash or arbitrary code execution in the process context.
Recommendation
Update Squirrel to the latest available version if a patch exists, or apply temporary mitigations such as restricting access to applications using this library.
Other vulnerabilities in Squirrel
See all- CVE-2026-9541Medium
A heap-based buffer overflow vulnerability exists in Squirrel up to version 3.2 in the ReadObject function of squirrel/sqobject.cpp (Cnut File Handler component). Local access is required and the exploit has been made public.
- CVE-2026-8258Medium
In the Squirrel library up to version 3.2, a stack-based buffer overflow vulnerability exists in the validate_format function in sqstdlib/sqstdstring.cpp. The attack can only be executed locally. The exploit has been published and may be used. The project was informed but has not responded.
Original NVD description (English source)
A vulnerability was determined in Squirrel up to 3.2. This affects the function SQFunctionProto::Load of the file squirrel/sqobject.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS