CVE-2026-2661
published 2026-02-18CVE-2026-2661: A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation…
PriorityP348high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.24%
14.4th percentile
A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | squirrel3 | — | — |
| squirrel-lang | squirrel | <= 3.2 | — |
| squirrel-lang | squirrel | — | — |
| squirrel-lang | squirrel | — | — |
| squirrel-lang | squirrel | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.7LOWAV:L/AC:L/Au:S/C:N/I:N/A:P
osv4.8MEDIUM
vendor_debian4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2026-2661: squirrel3 - A security flaw has been discovered in Squirrel up to 3.2. This affects the func...
vendor_debian·2026·CVSS 4.8
CVE-2026-2661 [MEDIUM] CVE-2026-2661: squirrel3 - A security flaw has been discovered in Squirrel up to 3.2. This affects the func...
A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Scope: local
bullseye: open
forky: open
sid: open
trixie: open
OSV
CVE-2026-2661: A security flaw has been discovered in Squirrel up to 3
osv·2026-02-18·CVSS 4.8
CVE-2026-2661 [MEDIUM] CVE-2026-2661: A security flaw has been discovered in Squirrel up to 3
A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
GHSA
GHSA-pppv-pc54-6j8r: A security flaw has been discovered in Squirrel up to 3
ghsa_unreviewed·2026-02-18
CVE-2026-2661 [MEDIUM] CWE-119 GHSA-pppv-pc54-6j8r: A security flaw has been discovered in Squirrel up to 3
A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
No detection rules found.
No public exploits indexed.
2026-02-18
Published