PT-2026-22510 · Squirrel · Squirrel

Oneafter · Publicado 2026-01-01 · Atualizado 2026-03-05 · CVE-2026-3388

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squirrel versions prior to 3.3

Description A flaw exists in the Squirrel compiler, specifically within the SQCompiler::Factor and SQCompiler::UnaryOP functions located in the squirrel/sqcompiler.cpp file. This issue allows for uncontrolled recursion through manipulation, potentially leading to a denial-of-service condition. The exploit has been publicly released. The issue was reported to the project developers, but no response has been received.

Recommendations Versions prior to 3.3 should be updated. As a temporary workaround, consider restricting or disabling the use of the SQCompiler::Factor and SQCompiler::UnaryOP functions until a patch is available.

Exploit

Correção

Uncontrolled Recursion

Improper Resource Release

Enumeração de Fraquezas

CWE-674

CWE-404

Identificadores relacionados

CVE-2026-3388

Produtos afetados

Squirrel

Referências · 19

• 🔥 https://github.com/oneafter/0122/blob/main/i312/repro · Exploit
• https://github.com/albertodemichelis/squirrel/issues/312 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3388 · Nota de Segurança
• https://twitter.com/CVEnew/status/2028067069103841506 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3388 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-3388 · Aviso do Fabricante
• https://t.me/cveNotify/153667 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2026-3388 · Aviso do Fabricante
• https://t.me/CVEtracker/46062 · Publicação no Telegram
• https://security-tracker.debian.org/tracker/CVE-2026-3388 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2028086025923285235 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2028068025316892764 · Publicação no Twitter
• https://vuldb.com/?id.348274 · Nota
• https://twitter.com/VulmonFeeds/status/2028061241369924056 · Publicação no Twitter
• https://t.me/cveNotify/154251 · Publicação no Telegram