CVE-2026-9541
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A heap-based buffer overflow vulnerability exists in Squirrel up to version 3.2 in the ReadObject function of squirrel/sqobject.cpp (Cnut File Handler component). Local access is required and the exploit has been made public.
Risk Assessment
A local attacker can crash the application or potentially execute arbitrary code. The vulnerability is publicly known, increasing the risk of exploitation.
Recommendation
Update Squirrel to a version above 3.2 if available. Restrict local access to the system.
Other vulnerabilities in Squirrel
See all- CVE-2026-8261Medium
A heap-based buffer overflow vulnerability was found in Squirrel up to version 3.2 in the SQFunctionProto::Load function in squirrel/sqobject.cpp. The attack requires local access and is publicly disclosed, but the project has not responded.
- CVE-2026-8258Medium
In the Squirrel library up to version 3.2, a stack-based buffer overflow vulnerability exists in the validate_format function in sqstdlib/sqstdstring.cpp. The attack can only be executed locally. The exploit has been published and may be used. The project was informed but has not responded.
Original NVD description (English source)
A security flaw has been discovered in Squirrel up to 3.2. Impacted is the function ReadObject of the file squirrel/sqobject.cpp of the component Cnut File Handler. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.