CVE-2026-3389 — Improper Resource Shutdown or Release in Squirrel

CWE-404 — Improper Resource Shutdown or ReleaseCWE-476 — NULL Pointer Dereference5 documents5 sources
Severity
4.8MEDIUMNVD
EPSS
0.0%
top 92.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Squirrel-lang SquirrelDebian Squirrel3
Timeline
PublishedMar 1

Description

A vulnerability was determined in Squirrel up to 3.2. This vulnerability affects the function sqstd_rex_newnode in the library sqstdlib/sqstdrex.cpp. Executing a manipulation can lead to null pointer dereference. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Packages3 packages

▶CVEListV5squirrel-lang/squirrel3.0, 3.1, 3.2+2

🔴Vulnerability Details

2
OSV
CVE-2026-3389: A vulnerability was determined in Squirrel up to 3↗2026-03-01
▶
GHSA
GHSA-g9mq-qjc2-8pgx: A vulnerability was determined in Squirrel up to 3↗2026-03-01
▶

📋Vendor Advisories

1
Debian
CVE-2026-3389: squirrel3 - A vulnerability was determined in Squirrel up to 3.2. This vulnerability affects...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-3389 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-3389 — Improper Resource Shutdown or Release | cvebase