CVE-2021-41556 | sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 al… | CVSS 10.0 CRITICAL

Description

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.

Metadata

CVE ID: CVE-2021-41556
State: PUBLISHED
Assigner: mitre
Reserved: 2021-09-22 00:00 UTC
Published: 2022-07-28 20:41 UTC
Last updated: 2026-05-29 18:48 UTC
Primary CWE: CWE-125
CWE-125 Out-of-bounds Read
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-125	adp	CWE-125 Out-of-bounds Read

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (5)