CVE-2026-2661

NameCVE-2026-2661
DescriptionA security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
squirrel3 (PTS)bullseye3.1-8vulnerable
trixie3.1-8.2vulnerable
forky, sid3.1-8.3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
squirrel3source(unstable)(unfixed)

Notes

https://github.com/albertodemichelis/squirrel/issues/310

Search for package or bug name: Reporting problems