CVE-2026-3388
published 2026-03-01CVE-2026-3388: A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.17%
6.6th percentile
A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. The attack needs to be approached locally. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | squirrel3 | — | — |
| squirrel-lang | squirrel | <= 3.2 | — |
| squirrel-lang | squirrel | — | — |
| squirrel-lang | squirrel | — | — |
| squirrel-lang | squirrel | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.01.7LOWAV:L/AC:L/Au:S/C:N/I:N/A:P
osv4.8MEDIUM
vendor_debian4.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-px8q-3qhf-3h43: A vulnerability was found in Squirrel up to 3
ghsa_unreviewed·2026-03-01
CVE-2026-3388 [MEDIUM] CWE-404 GHSA-px8q-3qhf-3h43: A vulnerability was found in Squirrel up to 3
A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. The attack needs to be approached locally. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
OSV
CVE-2026-3388: A vulnerability was found in Squirrel up to 3
osv·2026-03-01·CVSS 4.8
CVE-2026-3388 [MEDIUM] CVE-2026-3388: A vulnerability was found in Squirrel up to 3
A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. The attack needs to be approached locally. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Debian
CVE-2026-3388: squirrel3 - A vulnerability was found in Squirrel up to 3.2. This affects the function SQCom...
vendor_debian·2026·CVSS 4.8
CVE-2026-3388 [MEDIUM] CVE-2026-3388: squirrel3 - A vulnerability was found in Squirrel up to 3.2. This affects the function SQCom...
A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. The attack needs to be approached locally. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Scope: local
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-3388 squirrel: Squirrel: Denial of Service via uncontrolled recursion in compiler functions [fedora-all]
bugzilla·2026-03-02·CVSS 5.5
CVE-2026-3388 [MEDIUM] CVE-2026-3388 squirrel: Squirrel: Denial of Service via uncontrolled recursion in compiler functions [fedora-all]
CVE-2026-3388 squirrel: Squirrel: Denial of Service via uncontrolled recursion in compiler functions [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Bugzilla
CVE-2026-3388 codeblocks: Squirrel: Denial of Service via uncontrolled recursion in compiler functions [fedora-all]
bugzilla·2026-03-02·CVSS 5.5
CVE-2026-3388 [MEDIUM] CVE-2026-3388 codeblocks: Squirrel: Denial of Service via uncontrolled recursion in compiler functions [fedora-all]
CVE-2026-3388 codeblocks: Squirrel: Denial of Service via uncontrolled recursion in compiler functions [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Bugzilla
CVE-2026-3388 supertux: Squirrel: Denial of Service via uncontrolled recursion in compiler functions [fedora-all]
bugzilla·2026-03-02·CVSS 5.5
CVE-2026-3388 [MEDIUM] CVE-2026-3388 supertux: Squirrel: Denial of Service via uncontrolled recursion in compiler functions [fedora-all]
CVE-2026-3388 supertux: Squirrel: Denial of Service via uncontrolled recursion in compiler functions [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Wiz
CVE-2026-3388 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.8
CVE-2026-3388 [MEDIUM] CVE-2026-3388 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-3388 :
Homebrew vulnerability analysis and mitigation
A vulnerability was found in Squirrel up to 3.2. This affects the function SQCompiler::Factor/SQCompiler::UnaryOP of the file squirrel/sqcompiler.cpp. Performing a manipulation results in uncontrolled recursion. The attack needs to be approached locally. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Source : NVD
## 4.8
Score
Published March 1, 2026
Severity MEDIUM
CNA Score 4.8
Affected Technologies
Homebrew
Linux Debian
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.4
Exploitation Probability (EPSS) N/A
Affected
2026-03-01
Published