Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-2661 is a heap-based buffer overflow vulnerability in the Squirrel virtual machine (VM) up to version 3.2. It occurs in the function SQObjectPtr::operator= within the source file squirrel/sqobject.h.'}, {'type': 'paragraph', 'content': "The vulnerability is caused by uncontrolled infinite recursion triggered by repeated metamethod calls (_set and _get) during script execution. This recursion leads to stack exhaustion or corruption because the VM's internal execution stack, implemented as a heap-allocated vector (sqvector<SQObjectPtr>), grows beyond its allocated heap buffer."}, {'type': 'paragraph', 'content': 'Specifically, the VM fails to properly check or enforce stack limits during recursive property assignments that invoke the _set metamethod repeatedly, causing the stack to overflow and resulting in a memory access violation 8 bytes beyond the end of a 16KB allocated heap buffer.'}, {'type': 'paragraph', 'content': 'This heap buffer overflow can cause crashes or memory corruption. The vulnerability requires local access to exploit and has a publicly available proof-of-concept exploit.'}] [1, 3, 4]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Squirrel VM to crash due to heap buffer overflow, potentially leading to denial of service or memory corruption.

Since the exploit requires local access, an attacker with local privileges could trigger the infinite recursion to cause the VM to crash or behave unpredictably.

The impact is primarily on system availability, as the heap overflow can disrupt normal operation of applications using the Squirrel VM.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a heap-based buffer overflow caused by uncontrolled infinite recursion in the Squirrel VM during script execution. Detection involves monitoring for crashes or memory access violations related to the Squirrel VM, especially those triggered by recursive property assignments invoking the `_set` and `_get` metamethods.

Since the vulnerability requires local access and is triggered by specific script behavior, detection can be performed by running the provided reproduction script that triggers the infinite recursion and heap buffer overflow.

Suggested commands to detect the vulnerability include:

• Build the Squirrel VM with AddressSanitizer (ASan) enabled in Release mode.
• Run the repro script to trigger the vulnerability: `./build/bin/sq repro`
• Monitor system logs or ASan output for heap-buffer-overflow errors or crashes related to `SQObjectPtr::operator=`.
• Use debugging tools like AddressSanitizer or Valgrind to detect memory corruption during execution of Squirrel scripts.

Useful 0 Not Useful 0

Mitigation Strategies

Currently, no official patches or countermeasures have been provided by the Squirrel project to address this vulnerability.

Immediate mitigation steps include:

• Restrict local access to systems running vulnerable versions of the Squirrel VM to prevent exploitation.
• Avoid running untrusted or malicious scripts that could trigger the infinite recursion in metamethod calls.
• Consider using alternative products or versions of Squirrel that are not affected by this vulnerability.
• Monitor for updates or patches from the Squirrel project and apply them once available.

Useful 0 Not Useful 0