The vulnerability in the Squirrel scripting language allows a local attacker to trigger a null pointer dereference when the sqstd_rex_newnode function in sqstdlib/sqstdrex.cpp processes certain inputs, causing a crash that results in denial of service to the running script or application.

Affected versions include all releases of Squirrel up to and including 3.2. The issue specifically targets the regex subsystem contained in the sqstd_rex_newnode implementation, and any environment that uses this function is potentially exposed.

The CVSS score of 4.8 reflects a moderate severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation. Because the attack vector is local, only users with local execution privileges can exploit the flaw, but as soon as a malicious script is executed it can crash the runtime. The flaw is not in the CISA KEV catalog, and no vendor patch has been released yet, so the risk depends on the ability of attackers to supply and run untrusted code locally.