Vulnerability · Published Feb 18, 2026 · Assigned by VulDB

CVE-2026-2661Squirrel sqobject.h operator heap-based overflow

Low 3.3

In plain English

A low-severity heap buffer overflow in Squirrel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	squirrel3	no fix listed	DEBIAN-CVE-2026-2661
Ubuntu:22.04:LTS	squirrel3	no fix listed	UBUNTU-CVE-2026-2661
Ubuntu:25.10	squirrel3	no fix listed	UBUNTU-CVE-2026-2661
Ubuntu:26.04:LTS	squirrel3	no fix listed	UBUNTU-CVE-2026-2661
Ubuntu:26.10	squirrel3	no fix listed	UBUNTU-CVE-2026-2661

Affected products (as reported)

Vendor	Product	Versions
n/a	Squirrel	3.03.13.2

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

References

VDB-346459 | Squirrel sqobject.h operator heap-based overflow vdb-entry, technical-description
VDB-346459 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #753165 | albertodemichelis squirrel master-branch Heap-based Buffer Overflow third-party-advisory
https://github.com/albertodemichelis/squirrel/issues/310 issue-tracking
https://github.com/oneafter/0122/blob/main/i310/repro exploit