A stack-based buffer overflow exists in the validate_format function of Squirrel’s sqstdstring.cpp implementation. The flaw can be triggered by carefully crafted input processed by the library, leading to overwriting the stack and potentially corrupting control data. With the CVSS score of 4.8, the vulnerability presents low‑to‑moderate risk but can cause application crashes or, in the worst case, local code execution if an attacker can influence the input data.

The vulnerability affects the Squirrel library up to version 3.2. No higher versions are known to contain the flaw, and the project has not yet released a fix. Systems that incorporate Squirrel 3.2 or earlier and allow untrusted input to reach validate_format are at risk.

According to the description, exploitation is limited to a local context; an attacker must have the ability to run code that uses Squirrel. Exploit code has been publicly published, which indicates that the vulnerability remains available in the wild. Because EPSS is not provided and the vulnerability is not listed in the CISA KEV catalog, the exploitation probability is unclear, but publicly known exploits confirm that the flaw can be used. The CVSS score of 4.8 reflects the low severity and indicates a moderate chance of successful exploitation with local privileges. Monitoring for abuse and applying mitigations are recommended.