$ cve CVE-2021-41556 JSON

CVE-2021-41556

10.0

CRITICAL · CVSS 3.1 · EPSS 2.8% (pctl 86)

In your normal cycle

Critical by CVSS (10), but no sign of active exploitation.

Description

sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.

Scoring

CVSS	10.0 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS	2.76% — more likely to be exploited than 86% of all CVEs
Weakness	CWE-125
On CISA KEV	no
Public exploit	none known
Published	2022-07-28
Last modified	2026-06-17

Affected (2)

Vendor	Product
fedoraproject	fedora
squirrel-lang	squirrel

References

→ the Explorer · watch your stack · NVD