CVE-2022-30292

CVE-2022-30292 affects SQUIRREL 3.2 and earlier; heap-based buffer overflow in sqbaselib.cpp’s thread_call due to missing sq_reservestack. Reported impact includes DoS, with potential sandbox escape and possible arbitrary code execution per linked exploit notes. Exploitation requires crafting Squ...

CVE-2021-41556

CVE-2021-41556 affects the Squirrel engine (sqclass.cpp in the core interpreter) up to Squirrel 2.2.5 and 3.x up to 3.1. The vulnerability is an out-of-bounds read in the interpreter that can lead to code execution when a victim runs attacker-controlled Squirrel scripts, potentially breaking out ...

CVE-2026-3388

CVE-2026-3388 affects Squirrel up to 3.2, specifically SQCompiler::Factor and SQCompiler::UnaryOP in squirrel/sqcompiler.cpp. According to public descriptions, manipulating these paths triggers uncontrolled recursion, with local attack requirements and a public exploit/proofs‑of‑concept available...

CVE-2026-2661

CVE-2026-2661 affects Squirrel up to 3.2, specifically the SQObjectPtr::operator in squirrel/sqobject.h. The public documentation describes a heap-based overflow arising from improper handling in that operator, enabling local exploitation. A separate PacketStorm report attributes a related issue ...

CVE-2026-3389

CVE-2026-3389 affects Squirrel up to version 3.2. The vulnerability targets sqstd_rex_newnode in sqstdlib/sqstdrex.cpp, leading to a null pointer dereference when manipulated. Exploitation is local, and a public disclosure indicates potential use in the wild. The project was informed early via an...

CVE-2026-2659

The vulnerability CVE-2026-2659 affects Squirrel up to version 3.2. It resides in SQFuncState::PopTarget within src/squirrel/squirrel/sqfuncstate.cpp, where manipulating the _target_stack can cause an out-of-bounds read during local execution. Publicly disclosed exploits exist per the sources, an...

CVE-2026-9541

CVE-2026-9541 affects Squirrel up to 3.2, specifically the ReadObject function in squirrel/sqobject.cpp of the Cnut File Handler. The issue is a heap-based buffer overflow triggered by manipulation of input, with local attack vectors. Public exploit has been released; the vendor was notified earl...