Analyst readout for executives and security teams
Plain-English summary
CVE-2026-9541 is a heap-based buffer overflow in Squirrel 3.0 through 3.2 when handling Cnut files. The stated attack path requires local access and low privileges, so broad remote compromise is not supported by the sources. Public exploit material exists, and the project reportedly has not responded.
Executive priority
Treat this as a medium-priority local-exposure issue. Prioritize environments where Squirrel is embedded in products used by multiple local users or where untrusted local files are processed. Do not treat it as an internet-scale emergency based on the provided evidence.
Technical view
The flaw affects ReadObject in squirrel/sqobject.cpp within the Cnut File Handler. Manipulated input can trigger heap memory corruption, mapped to CWE-119 and CWE-122. The CVSS 3.1 score is 5.3 with local attack vector, low complexity, low privileges, no user interaction, and limited confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely where applications embed Squirrel 3.0, 3.1, or 3.2 and allow local users or local workflows to load Cnut files. Internet-facing exposure is not supported by the provided sources. Embedded copies may be harder to identify than standalone installations.
Exploitation context
The source bundle says exploit code has been released publicly and may be used for attacks. It does not show CISA KEV listing or confirmed active exploitation. Because the attack requires local access and privileges, risk is higher on shared systems, developer workstations, and products processing local scripts or assets.
Researcher notes
Evidence indicates public exploit availability but no confirmed active exploitation. The vendor response and fixed version are unclear in the provided sources. Validation should focus on version discovery, embedded library identification, and whether Cnut parsing is reachable from untrusted local input.
Mitigation direction
- Inventory standalone and embedded Squirrel versions across products and build dependencies.
- Restrict Cnut file loading to trusted local users and trusted file sources.
- Disable or isolate Cnut file handling where it is not required.
- Monitor the upstream GitHub issue and CVE sources for vendor guidance.
- Apply vendor or maintainer fixes when they become available.
Validation and detection
- Confirm whether deployed software uses Squirrel 3.0, 3.1, or 3.2.
- Identify workflows that load Cnut files from local users or untrusted sources.
- Review crash reports for heap corruption near ReadObject or Cnut parsing.
- Check whether embedded Squirrel copies differ from upstream source versions.
- Track the public issue and advisory records for updated remediation details.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-9541 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R 1.8 3.4 VulDB CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R 1.8 3.4 VulDB CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P — — VulDB AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR 3.1 6.4 VulDB Vulnerability scoring details
Base CVSS 4.0 score
4.8 MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
5.3 MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Base CVSS 3.0 score
5.3 MediumVector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
Base CVSS 2.0 score
4.3 MediumVector: AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timeline VulDB
Advisory disclosed
- Source timeline VulDB
VulDB entry created
- CVE reserved CVE Program
The CVE ID was reserved by the assigning CNA.
- Source timeline VulDB
VulDB entry last update
- CVE published CVE Program
The CVE record was published.
- CVE updated CVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 source CVE List V5
- VDB-365602 | Squirrel Cnut File sqobject.cpp ReadObject heap-based overflow CVE reference, VulDB · vdb-entry, technical-description
- VDB-365602 | CTI Indicators (IOB, IOC, IOA) CVE reference, VulDB · signature, permissions-required
- Submit #814826 | albertodemichelis squirrel 3.2 Heap-based Buffer Overflow CVE reference, VulDB · third-party-advisory
- https://github.com/albertodemichelis/squirrel/issues/327 CVE reference, VulDB · issue-tracking
- https://github.com/biniamf/pocs/tree/main/squirrel-sqobject-readobject-neg-len-oob CVE reference, VulDB · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.