Log in Start free

Vulnerability · Published Jul 28, 2022 · Assigned by mitre

CVE-2021-41556

Critical 10.0

In plain English

A critical-severity out-of-bounds read in the squirrel3 package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)2.9%top 12.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13squirrel33.1-8.2+deb13u1DEBIAN-CVE-2021-41556
Ubuntu:22.04:LTSsquirrel3no fix listedUBUNTU-CVE-2021-41556
Ubuntu:25.10squirrel3no fix listedUBUNTU-CVE-2021-41556
Ubuntu:26.04:LTSsquirrel3no fix listedUBUNTU-CVE-2021-41556
Ubuntu:26.10squirrel3no fix listedUBUNTU-CVE-2021-41556

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References