A flaw in the Squirrel compiler causes recursive calls in SQCompiler::Factor and SQCompiler::UnaryOP during parsing of certain unary operators, leading to unbounded recursion and eventual stack exhaustion. The description states that the uncontrolled recursion can be triggered by executing a crafted Squirrel script, which results in a denial of service. The bug is associated with CWE-404 (Missing Exception Handling) and CWE-674 (Recursive Calls).

All builds of the Squirrel language compiler up to and including version 3.2 are affected. The vulnerability exists in the sqcompiler.cpp source used by every platform that compiles Squirrel code, and it is not limited to a specific operating system or deployment scenario.

The CVSS score of 4.8 indicates a moderate severity. The EPSS score is below 1%, showing a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is local; the exploit requires the attacker to run a malicious Squirrel script on the target machine. No remote code execution or credential compromise is possible through this flaw.