The vulnerability resides in the function SQFuncState::PopTarget within src/squirrel/squirrel/sqfuncstate.cpp of Squirrel, affecting all releases up to 3.2. By manipulating the _target_stack argument, the interpreter performs an out‑of‑bounds read, enabling the disclosure of arbitrary memory content. This can expose confidential data, configuration details, or secrets held in memory, potentially compromising the confidentiality of the local system. The flaw does not grant write access or code execution, so the integrity or availability impact is limited to information leakage.

All installations of the Squirrel scripting language up to and including version 3.2 are affected. The flaw exists in the core interpreter code and does not affect later major releases, although no official patch is currently documented. Users running any Squirrel script or application that embeds the interpreter should verify their version. No specific vendor or Product release notes identify a fix, so the affected range is broadly defined as "Squirrel <= 3.2".

The base CVSS score of 4.8 indicates a moderate severity, and the EPSS probability is below 1 %, suggesting very low exploitation likelihood at present. The vulnerability is confirmed as locally exploitable; an attacker with local access could construct a malicious script to trigger the out‑of‑bounds read. The vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale exploitation. Overall, the risk is moderate for environments where local code execution is possible, but unlikely to be abused at this time.