Medium severity · published May 11, 2026
CVE-2026-8258
Squirrel sqstdstring.cpp validate_format stack-based overflow
5.3
CVSS
0.1%
EPSS
No
On KEV
Description
A flaw has been found in Squirrel up to 3.2. Impacted is the function validate_format in the library sqstdlib/sqstdstring.cpp. Executing a manipulation can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squirrel ·
3.0; 3.1; 3.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8258
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8258
github.com
https://github.com/albertodemichelis/squirrel/issues/325
github.com
https://github.com/biniamf/pocs/tree/main/squirrel-validate_format-memcpy-oob
vuldb.com
https://vuldb.com/submit/809873
vuldb.com
https://vuldb.com/vuln/362555
vuldb.com
https://vuldb.com/vuln/362555/cti
More from Squirrel
7.8
CVE-2026-2661
Squirrel sqobject.h operator heap-based overflow
7.8
CVE-2026-2659
Squirrel sqfuncstate.cpp PopTarget out-of-bounds
5.9
CVE-2026-8261
Squirrel sqobject.cpp Load heap-based overflow
5.5
CVE-2026-3389
Squirrel sqstdrex.cpp sqstd_rex_newnode null pointer dereference
5.5
CVE-2026-3388
Squirrel sqcompiler.cpp UnaryOP recursion