Vulnerability · Published May 26, 2026 · Assigned by VulDB
CVE-2026-9541Squirrel Cnut File sqobject.cpp ReadObject heap-based overflow
Medium 5.3
In plain English
A medium-severity heap buffer overflow in Squirrel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Official description
A security flaw has been discovered in Squirrel up to 3.2. Impacted is the function ReadObject of the file squirrel/sqobject.cpp of the component Cnut File Handler. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | squirrel3 | no fix listed | DEBIAN-CVE-2026-9541 |
| Ubuntu:22.04:LTS | squirrel3 | no fix listed | UBUNTU-CVE-2026-9541 |
| Ubuntu:25.10 | squirrel3 | no fix listed | UBUNTU-CVE-2026-9541 |
| Ubuntu:26.04:LTS | squirrel3 | no fix listed | UBUNTU-CVE-2026-9541 |
| Ubuntu:26.10 | squirrel3 | no fix listed | UBUNTU-CVE-2026-9541 |
Affected products (as reported)
Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-365602 | Squirrel Cnut File sqobject.cpp ReadObject heap-based overflow vdb-entry, technical-description
- VDB-365602 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #814826 | albertodemichelis squirrel 3.2 Heap-based Buffer Overflow third-party-advisory
- https://github.com/albertodemichelis/squirrel/issues/327 issue-tracking
- https://github.com/biniamf/pocs/tree/main/squirrel-sqobject-readobject-neg-len-oob exploit