CVE-2026-3389: 
Homebrew vulnerability analysis and mitigation

CVE-2026-3389 is a NULL pointer dereference vulnerability in the Squirrel scripting language (squirrel-lang) affecting all versions up to and including 3.2. The flaw resides in the sqstd_rex_newnode function within sqstdlib/sqstdrex.cpp, triggered during regex compilation with a specially crafted regular expression. It was reported via a GitHub issue on January 22, 2026, and publicly disclosed on March 1, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in sqstd_rex_newnode at sqstdlib/sqstdrex.cpp:85, called during regex AST construction by sqstd_rex_compile. When a specially crafted regex is compiled — for example, one that exceeds internal node limits or triggers an allocation failure — the function attempts a WRITE memory access through a NULL pointer without validating it first, causing a segmentation fault. Exploitation requires local access and low privileges; an attacker must be able to supply a malicious regex string to an application embedding the Squirrel interpreter. A public proof-of-concept reproducer is available, consisting of a short Squirrel script using regexp(@"\p|)") to trigger the crash (GitHub Issue, PoC Reproducer).

Successful exploitation causes the host application embedding Squirrel to crash, resulting in a denial of service (DoS) condition. There is no impact on confidentiality or data integrity — the vulnerability cannot be used for privilege escalation, code execution, or data exfiltration. The scope is limited to application availability, affecting any software that embeds Squirrel versions up to 3.2 and exposes regex compilation to local, low-privileged users (Red Hat Bugzilla, GitHub Issue).

A public proof-of-concept exploit is available on GitHub, consisting of a minimal Squirrel script that triggers the crash. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (PoC Reproducer, Red Hat Advisory).

1. Identify target: Locate a system running an application that embeds Squirrel version 3.2 or earlier and allows local users to execute Squirrel scripts or supply regex patterns.
2. Craft malicious script: Prepare a Squirrel script containing a specially crafted regex that triggers the NULL pointer dereference, such as:

local ex = regexp("");
ex = regexp(@"\p|)");
string = "123 Teso(omething(str, getTemp1);";
res = ex.search(string);

3. Execute the script: Run the crafted script using the Squirrel interpreter (sq repro) or supply the malicious regex to the vulnerable application's Squirrel-based scripting interface.
4. Trigger crash: The sqstd_rex_newnode function in sqstdlib/sqstdrex.cpp:85 attempts a WRITE to a NULL pointer during regex AST construction, causing a segmentation fault and crashing the host application (GitHub Issue, PoC Reproducer).

• Process: Unexpected crashes or segmentation faults in applications embedding the Squirrel interpreter; core dump files generated by the Squirrel sq binary or embedding application.
• Logs: Application logs showing SIGSEGV or Segmentation fault errors referencing sqstdrex.cpp or sqstd_rex_newnode; ASAN output containing AddressSanitizer: SEGV on unknown address 0x000000000000 with stack frames pointing to sqstd_rex_newnode and sqstd_rex_compile.
• File System: Presence of unexpected Squirrel script files (.nut) containing regex patterns with unusual constructs such as \p|) in directories accessible to low-privileged users (GitHub Issue).

No official patch has been released by the upstream Squirrel project as of the time of disclosure, and the project had not responded to the issue report. Red Hat has tracked the issue in Bugzilla (Bug 2443638) and patch details are being monitored. In the interim, administrators should restrict local system access to trusted users only, avoid exposing Squirrel scripting interfaces to untrusted input, and consider disabling or sandboxing Squirrel regex functionality if patching cannot be immediately applied. Monitor for unexpected application crashes in systems running Squirrel 3.0, 3.1, or 3.2 (Red Hat Bugzilla, Red Hat Advisory).

The vulnerability was noted in automated CVE tracking feeds including CVEnew on Nitter and Bluesky, with standard community aggregation across VulDB, Vulners, and ENISA EUVD. Red Hat's Product Security team imported the issue into Bugzilla for tracking. No significant researcher commentary or media coverage beyond routine CVE aggregation has been observed, consistent with the vulnerability's limited impact scope (DoS only, local access required) (Red Hat Advisory).