CVE-2021-41556: Critical severity Squirrel-lang Squirrel vulnerability
sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a victim executes an attacker-controlled squirrel script, it is possible for the attacker to break out of the squirrel script sandbox even if all dangerous functionality such as File System functions has been disabled. An attacker might abuse this bug to target (for example) Cloud services that allow customization via SquirrelScripts, or distribute malware through video games that embed a Squirrel Engine.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-41556?
CVE-2021-41556 is a vulnerability in Squirrel through 2.2.5 and 3.x through 3.1 that allows an out-of-bounds read in the core interpreter, leading to potential code execution.
What is the severity of CVE-2021-41556?
CVE-2021-41556 has a severity value of 10, which is classified as critical.
Which software versions are affected by CVE-2021-41556?
Squirrel versions 2.2.5 and 3.x through 3.1 are affected by CVE-2021-41556.
How can an attacker exploit CVE-2021-41556?
An attacker can exploit CVE-2021-41556 by executing a squirrel script under their control and breaking out of the squirrel script sandbox.
How can I fix CVE-2021-41556?
To fix CVE-2021-41556, it is recommended to update Squirrel to a patched version. Check the official Squirrel-lang website for available downloads and apply the necessary updates.