Technical impact
The vulnerability resides in the SQFunctionProto::Load routine within squirrel/sqobject.cpp and triggers a heap‑based buffer overflow when handling certain input. The flaw is a classic out‑of‑bounds write (CWE‑119, CWE‑120, CWE‑122) that can corrupt memory and potentially lead to arbitrary code execution or process crash, but only within the context of the running process. The impact is therefore confined to local execution on a system where the Squirrel interpreter is run, and it does not expose directly any network‑accessible attack surface.
Affected Systems
All versions of the Squirrel project up to and including 3.2 are affected. Users running the base interpreter or any applications that embed Squirrel 3.2 or earlier should consider themselves vulnerable, as the flaw lies in the core function that loads prototype information.
Risk and Exploitability
The CVSS score of 5.1 indicates moderate severity, reflecting that the vulnerability requires local privilege and does not grant widespread network damage. The EPSS score of <1% (approximately 0.00021) indicates a very low probability of exploitation in the wild, and the lack of a KEV listing suggests that there are no widespread exploitation reports yet. However, the vulnerability has been publicly disclosed and is available in proof‑of‑concept repositories, meaning a local attacker who can run code in the context of the Squirrel interpreter could exploit it with the known input vectors.
