CVE-2026-2661: 
Homebrew vulnerability analysis and mitigation

CVE-2026-2661 is a heap-based buffer overflow vulnerability in the Squirrel scripting language VM (squirrel-lang) affecting all versions up to and including 3.2. The flaw resides in the SQObjectPtr::operator= function within squirrel/sqobject.h and is triggered by uncontrolled recursion during metamethod dispatch. It was reported on January 22, 2026 via a GitHub issue and published to NVD on February 18, 2026; the project maintainer had not responded as of the disclosure date. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Red Hat CVE).

The root cause is uncontrolled recursion (CWE-674) combined with a heap-based buffer overflow (CWE-122). When a Squirrel script performs a property assignment that triggers a _set metamethod, which in turn triggers another assignment, the VM enters an infinite Execute → Call → FallBackSet → Set recursion loop. As the recursion deepens, the VM's internal execution stack (sqvector) is repeatedly reallocated via sqvector::_realloc; a pointer to a stack element becomes stale or out-of-bounds after reallocation, and the crash manifests as a READ 8 bytes past the end of a 16 KB heap-allocated region at SQObjectPtr::operator= (sqobject.h:269). Exploitation requires local access and the ability to supply a crafted Squirrel script to the VM. A public proof-of-concept reproducer script is available (GitHub Issue #310, PoC Repro).

Successful exploitation primarily causes a denial-of-service condition through application crash or availability disruption of any process hosting the Squirrel VM. Because the overflow occurs during a heap reallocation, there is a theoretical risk of memory corruption that could affect process integrity, though no confirmed code execution scenario has been demonstrated publicly. Confidentiality impact is considered low given the local-only attack vector and the nature of the crash (Feedly, GitHub Issue #310).

A public proof-of-concept reproducer script has been released on GitHub and is referenced in the NVD entry, lowering the bar for exploitation. The EPSS score is approximately 0.013% (0.000130), indicating a low probability of widespread exploitation in the near term. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (Feedly, PoC Repro).

1. Identify target: Locate a system or application that embeds the Squirrel VM (squirrel-lang ≤ 3.2) and allows local execution of Squirrel scripts (e.g., game engines, embedded scripting hosts).
2. Craft malicious script: Write a Squirrel script that defines a table with both _get and _set metamethods, where the _set metamethod performs a property assignment on the same object, creating a circular metamethod dispatch loop (as demonstrated in the public PoC).
3. Trigger the recursion: Execute the crafted script via the sq binary or the embedding application's script execution interface (e.g., ./sq repro).
4. Observe crash: The VM enters an infinite Execute → Call → FallBackSet → Set recursion, causing sqvector to grow unboundedly via repeated _realloc calls until a stale pointer is dereferenced 8 bytes past the allocated heap region, crashing the host process at SQObjectPtr::operator= (sqobject.h:269) (GitHub Issue #310, PoC Repro).

• Process: Unexpected crash or abnormal termination of any application embedding the Squirrel VM; process exit with a signal such as SIGSEGV or SIGABRT originating from sqobject.h or sqvm.cpp.
• Logs: AddressSanitizer (ASan) reports referencing heap-buffer-overflow at SQObjectPtr::operator= (sqobject.h:269) with a very deep call stack involving repeated FallBackSet/Set/Execute/Call frames.
• File System: Presence of unexpected Squirrel script files (.nut) in directories accessible to low-privileged users, particularly scripts containing _set/_get metamethods with self-referential property assignments.
• Network: No network-based IOCs are expected given the local-only attack vector (GitHub Issue #310).

No official patch has been released by the Squirrel project maintainer as of the disclosure date, and the maintainer had not responded to the issue report. Organizations should restrict local access to systems running Squirrel-embedded applications and limit which users can supply or execute Squirrel scripts. As a defense-in-depth measure, consider compiling the Squirrel VM with stack depth limits or adding a recursion counter guard in the Execute/FallBackSet call chain. Monitor the upstream repository (GitHub Issue #310) for any patch releases and apply them promptly when available (Red Hat CVE).

Red Hat has acknowledged the vulnerability and published a CVE tracking page, though no Red Hat products are listed as affected at this time. The broader security community has had limited public commentary, consistent with the low EPSS score and local-only attack vector. No significant media coverage or notable researcher commentary beyond the original GitHub issue report has been identified (Red Hat CVE, GitHub Issue #310).