Vulnerability · Published May 11, 2026 · Assigned by VulDB

CVE-2026-8258Squirrel sqstdstring.cpp validate_format stack-based overflow

Medium 5.3

In plain English

A medium-severity stack buffer overflow in Squirrel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.1%top 97.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in Squirrel up to 3.2. Impacted is the function validate_format in the library sqstdlib/sqstdstring.cpp. Executing a manipulation can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	squirrel3	no fix listed	DEBIAN-CVE-2026-8258
Ubuntu:22.04:LTS	squirrel3	no fix listed	UBUNTU-CVE-2026-8258
Ubuntu:25.10	squirrel3	no fix listed	UBUNTU-CVE-2026-8258
Ubuntu:26.04:LTS	squirrel3	no fix listed	UBUNTU-CVE-2026-8258
Ubuntu:26.10	squirrel3	no fix listed	UBUNTU-CVE-2026-8258

Affected products (as reported)

Vendor	Product	Versions
n/a	Squirrel	3.03.13.2

Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-362555 | Squirrel sqstdstring.cpp validate_format stack-based overflow vdb-entry, technical-description
VDB-362555 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #809873 | albertodemichelis squirrel 3.2 Stack-based Buffer Overflow third-party-advisory
https://github.com/albertodemichelis/squirrel/issues/325 issue-tracking
https://github.com/biniamf/pocs/tree/main/squirrel-validate_format-memcpy-oob exploit