CVE-2026-3388: 
Homebrew vulnerability analysis and mitigation

CVE-2026-3388 is an uncontrolled recursion vulnerability in the Squirrel scripting language compiler affecting versions up to and including 3.2. The flaw resides in the SQCompiler::Factor and SQCompiler::UnaryOP functions within squirrel/sqcompiler.cpp, where parsing deeply nested unary expressions (e.g., a long chain of ! or - operators) causes unbounded recursive calls that exhaust the call stack. The vulnerability was reported via a GitHub issue on January 22, 2026, and publicly disclosed on March 1, 2026 (Red Hat Bugzilla, GitHub Issue). It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (Red Hat Advisory).

The root cause is classified as CWE-674 (Uncontrolled Recursion), with secondary classifications of CWE-404 (Improper Resource Shutdown or Release) and CWE-835 (Loop with Unreachable Exit Condition). The Squirrel compiler's recursive-descent parser handles unary operators by calling UnaryOP, which in turn calls PrefixedExpr, which calls Factor again — creating a mutual recursion cycle with no depth limit check. An attacker with local access can craft a Squirrel script containing an extremely long sequence of unary operators (e.g., !!!!!!...x) that, when compiled, triggers thousands of recursive calls until the process stack is exhausted, resulting in a stack-overflow crash (GitHub Issue). A public proof-of-concept reproducer file is available at the reporter's GitHub repository (PoC Reproducer).

Successful exploitation causes a denial of service by crashing the Squirrel compiler/interpreter process via stack exhaustion. The impact is limited to availability — there is no confidentiality or integrity impact, as the vulnerability does not enable code execution or data disclosure. The affected scope is any application or system that embeds Squirrel 3.2 or earlier and allows local users to supply or execute arbitrary Squirrel scripts, such as game engines, automation tools, or scripting sandboxes (Red Hat Bugzilla, GitHub Issue).

A public proof-of-concept exploit (a crafted Squirrel script file) has been available since the initial disclosure on January 22, 2026, and is hosted on GitHub (PoC Reproducer). Exploitation requires local access with low privileges and no user interaction. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), reflecting a very low probability of exploitation in the near term (Red Hat Advisory).

1. Identify target: Locate a system running Squirrel version 3.2 or earlier where a local user can supply or execute Squirrel scripts (e.g., a game engine scripting console, embedded automation tool, or direct sq interpreter access).
2. Craft malicious script: Create a Squirrel script file containing an extremely long chain of unary operators applied to a value, such as !!!!!!...x (thousands of ! characters), which the parser must handle recursively for each operator.
3. Submit script for compilation: Execute the crafted script using the sq interpreter or trigger compilation through the embedding application: ./sq repro.
4. Trigger stack overflow: The compiler's Factor → PrefixedExpr → UnaryOP → Factor recursion cycle executes once per unary operator with no depth limit, rapidly exhausting the process stack and causing a crash (AddressSanitizer: stack-overflow or equivalent segmentation fault).
5. Achieve denial of service: The Squirrel interpreter or the embedding application process terminates abnormally, causing a denial of service for any functionality dependent on that process (GitHub Issue, PoC Reproducer).

• Process: Abnormal termination of the sq interpreter or any application embedding Squirrel, with exit codes indicating a crash (e.g., signal 11 SIGSEGV or SIGABRT on Linux).
• Logs: AddressSanitizer reports containing stack-overflow in SQCompiler::Factor() at squirrel/sqcompiler.cpp:718; application crash logs referencing SQCompiler::UnaryOP or SQCompiler::PrefixedExpr in the stack trace.
• File System: Presence of unusually large Squirrel script files (e.g., 30+ KB single-line files) containing repetitive unary operator sequences; core dump files generated by the Squirrel process.
• Network (if applicable): Unexpected script submissions or file uploads to services that compile or execute Squirrel scripts, particularly files with anomalously high ratios of operator characters to code content (GitHub Issue).

Upgrade Squirrel to a version beyond 3.2 that includes a fix for this recursion depth issue; patch details are tracked via the Red Hat Bugzilla entry and the upstream GitHub issue (Red Hat Bugzilla, GitHub Issue). Note that the upstream project had not responded to the issue report as of the disclosure date, so users should monitor the repository for an official patch. As a workaround, restrict local user access to systems running vulnerable Squirrel versions and prevent untrusted users from supplying arbitrary Squirrel scripts for compilation or execution. Applications embedding Squirrel should consider implementing a pre-compilation input length or operator-depth check as a defensive measure until an upstream fix is available (Red Hat Advisory).

Red Hat tracked the vulnerability through its security response process, filing a Bugzilla entry and assigning it medium priority and severity (Red Hat Bugzilla). The vulnerability was assigned the EU Vulnerability Database identifier EUVD-2026-9123 by ENISA (ENISA EUVD). Community reaction has been limited, consistent with the vulnerability's moderate severity and local-only attack vector; no significant vendor statements or notable researcher commentary beyond the initial issue report have been identified.