CVE-2026-8258

EUVD-2026-29014
A flaw has been found in Squirrel up to 3.2. Impacted is the function validate_format in the library sqstdlib/sqstdstring.cpp. Executing a manipulation can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 2.47%
Debian logo
Debian Releases
Debian Product
Codename
squirrel3
bullseye
postponed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
squirrel3
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
questing
ignored
resolute
needs-triage
Common Weakness Enumeration
References
https://github.com/albertodemichelis/squirrel/issues/325
https://github.com/biniamf/pocs/tree/main/squirrel-validate_format-memcpy-oob
https://vuldb.com/submit/809873
https://vuldb.com/vuln/362555
https://vuldb.com/vuln/362555/cti
https://github.com/albertodemichelis/squirrel/issues/325