The vulnerability originates in the SQObjectPtr::operator function defined in the squirrel/sqobject.h header of the Squirrel programming language. A flaw in how the operator handles internal buffers can cause a heap‑based buffer overflow when the function is invoked, allowing an attacker to corrupt memory or crash the process. The description explicitly notes that exploitation requires local access, but the public release of an exploit enables attackers who can run code within the target environment to trigger the overflow. This flaw is classified as an uncontrolled buffer overflow (CWE‑119) and a heap‑based buffer overflow (CWE‑122).

Squirrel language distributions up to and including version 3.2 are affected. The vulnerability is not limited to any specific platform; it applies to any build of Squirrel that contains the unpatched squirrel/sqobject.h implementation. The CPE entry confirms the vendor and product but does not narrow the affected release range beyond the stated version limit.

The CVSS score of 4.8 indicates a low severity assessment under current scoring metrics. EPSS indicates an exploitation probability below 1 %, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is local, an attacker must already have the capability to execute code within a Squirrel process or to supply input that is processed by the vulnerable function. Once the overflow is triggered, the attacker could potentially crash the application or manipulate heap data, which could affect application correctness or stability. The public availability of an exploit and the lack of an official vendor patch mean that any vulnerable system remains potentially exploitable by privileged local users.