PT-2026-22510 · Squirrel · Squirrel

Oneafter · Published 2026-01-01 · Updated 2026-03-05 · CVE-2026-3388

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Squirrel versions prior to 3.3

Description A flaw exists in the Squirrel compiler, specifically within the SQCompiler::Factor and SQCompiler::UnaryOP functions located in the squirrel/sqcompiler.cpp file. This issue allows for uncontrolled recursion through manipulation, potentially leading to a denial-of-service condition. The exploit has been publicly released. The issue was reported to the project developers, but no response has been received.

Recommendations Versions prior to 3.3 should be updated. As a temporary workaround, consider restricting or disabling the use of the SQCompiler::Factor and SQCompiler::UnaryOP functions until a patch is available.

Exploit

Fix

Uncontrolled Recursion

Improper Resource Release

Weakness Enumeration

CWE-674

CWE-404

Related Identifiers

CVE-2026-3388

Affected Products

Squirrel

References · 19

• 🔥 https://github.com/oneafter/0122/blob/main/i312/repro · Exploit
• https://github.com/albertodemichelis/squirrel/issues/312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3388 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-3388 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3388 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3388 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-3388 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3388 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3388 · Security Note
• https://twitter.com/CVEnew/status/2028067069103841506 · Twitter Post
• https://t.me/cveNotify/153667 · Telegram Post
• https://t.me/CVEtracker/46062 · Telegram Post
• https://twitter.com/cyberbivash/status/2028086025923285235 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028068025316892764 · Twitter Post
• https://vuldb.com/?id.348274 · Note