Squirrel sqobject.cpp Load heap-based overflow
Published May 11, 2026
5.1
MEDIUMCVSS 4.0
EPSS 0.21%
Description
A vulnerability was determined in Squirrel up to 3.2. This affects the function SQFunctionProto::Load of the file squirrel/sqobject.cpp. This manipulation causes heap-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected products
- Vendor n/a Product Squirrel Defaultn/a
- Version 3.0StatusaffectedConstraints-
- Version 3.1StatusaffectedConstraints-
- Version 3.2StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| n/a | Squirrel | n/a |
|
No data.
No data.
Deployment Validation Operator
dvo/deployment-validation-rhel8-operator
Fix deferred
MCP Server for Red Hat OpenShift
openshift-mcp-beta/openshift-mcp-server-rhel9
Fix deferred
Multicluster Global Hub
multicluster-globalhub/multicluster-globalhub-grafana-rhel9
Fix deferred
OpenShift Developer Tools and Services
helm
Fix deferred
OpenShift Lightspeed
openshift-lightspeed/openshift-mcp-server-rhel9
Fix deferred
OpenShift Service Mesh 2
openshift-service-mesh/istio-rhel8-operator
Fix deferred
OpenShift Service Mesh 3
openshift-service-mesh/istio-rhel9-operator
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/acm-grafana-rhel9
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/multicloud-integrations-rhel9
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/multicluster-operators-subscription-rhel9
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/submariner-operator-bundle
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/submariner-rhel9-operator
Fix deferred
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-main-rhel8
Fix deferred
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-rhel8-operator
Fix deferred
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-roxctl-rhel8
Fix deferred
Red Hat Advanced Cluster Security 4
advanced-cluster-security/rhacs-scanner-v4-rhel8
Fix deferred
Red Hat Ceph Storage 6
rhceph/rhceph-6-dashboard-rhel9
Fix deferred
Red Hat Ceph Storage 9
rhceph/alloy-rhel10
Fix deferred
Red Hat Ceph Storage 9
rhceph/grafana-rhel10
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-api-server-v2-rhel8
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-api-server-v2-rhel9
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-driver-rhel8
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-driver-rhel9
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-launcher-rhel8
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-launcher-rhel9
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8
Fix deferred
Red Hat OpenShift AI (RHOAI)
rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift3/ose-console
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4-dev-preview-beta/openperouter-edge-rhel10-operator
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4-dev-preview-beta/openperouter-operator-bundle
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4-dev-preview-beta/openperouter-rhel9-operator
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/metallb-operator-rhel8
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/metallb-rhel9-operator
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/oc-mirror-plugin-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-olm-rhel9-operator
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-console
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-console-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-helm-rhel9-operator
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-olm-catalogd-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-olm-operator-controller-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-operator-framework-tools-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-operator-lifecycle-manager-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-operator-registry-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-operator-sdk-rhel9
Fix deferred
Red Hat OpenShift GitOps
openshift-gitops-1/argocd-rhel8
Fix deferred
Red Hat OpenShift GitOps
openshift-gitops-1/argocd-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/bridge-marker-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/cluster-network-addons-operator-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/cnv-containernetworking-plugins-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/kubemacpool-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/kubesecondarydns-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/multus-dynamic-networks-rhel9
Fix deferred
Red Hat OpenShift Virtualization 4
container-native-virtualization/ovs-cni-plugin-rhel9
Fix deferred
Red Hat OpenStack Platform 16.2
rhosp-rhel8/osp-director-operator-bundle
Fix deferred
Red Hat OpenStack Platform 17.1
rhosp-rhel9/osp-director-operator-bundle
Fix deferred
Red Hat OpenStack Platform 18.0
rhoso-operators/openstack-operator-bundle
Fix deferred
Red Hat OpenStack Platform 18.0
rhoso-operators/rabbitmq-cluster-rhel9-operator
Fix deferred
Red Hat Trusted Artifact Signer
rhtas/policy-controller-rhel9-operator
Fix deferred
Red Hat Trusted Profile Analyzer
rhtpa/rhtpa-rhel9-operator
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Deployment Validation Operator | dvo/deployment-validation-rhel8-operator | Fix deferred | n/a |
| MCP Server for Red Hat OpenShift | openshift-mcp-beta/openshift-mcp-server-rhel9 | Fix deferred | n/a |
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Fix deferred | n/a |
| OpenShift Developer Tools and Services | helm | Fix deferred | n/a |
| OpenShift Lightspeed | openshift-lightspeed/openshift-mcp-server-rhel9 | Fix deferred | n/a |
| OpenShift Service Mesh 2 | openshift-service-mesh/istio-rhel8-operator | Fix deferred | n/a |
| OpenShift Service Mesh 3 | openshift-service-mesh/istio-rhel9-operator | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/multicloud-integrations-rhel9 | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/multicluster-operators-subscription-rhel9 | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/submariner-operator-bundle | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/submariner-rhel9-operator | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-main-rhel8 | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-rhel8-operator | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-roxctl-rhel8 | Fix deferred | n/a |
| Red Hat Advanced Cluster Security 4 | advanced-cluster-security/rhacs-scanner-v4-rhel8 | Fix deferred | n/a |
| Red Hat Ceph Storage 6 | rhceph/rhceph-6-dashboard-rhel9 | Fix deferred | n/a |
| Red Hat Ceph Storage 9 | rhceph/alloy-rhel10 | Fix deferred | n/a |
| Red Hat Ceph Storage 9 | rhceph/grafana-rhel10 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-api-server-v2-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-api-server-v2-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-driver-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-driver-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-launcher-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-launcher-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift3/ose-console | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4-dev-preview-beta/openperouter-edge-rhel10-operator | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4-dev-preview-beta/openperouter-operator-bundle | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4-dev-preview-beta/openperouter-rhel9-operator | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/metallb-operator-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/metallb-rhel9-operator | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/oc-mirror-plugin-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-olm-rhel9-operator | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-helm-rhel9-operator | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-olm-catalogd-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-olm-operator-controller-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-operator-framework-tools-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-operator-lifecycle-manager-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-operator-registry-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-operator-sdk-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift GitOps | openshift-gitops-1/argocd-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift GitOps | openshift-gitops-1/argocd-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/bridge-marker-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/cluster-network-addons-operator-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/cnv-containernetworking-plugins-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/kubemacpool-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/kubesecondarydns-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/multus-dynamic-networks-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Virtualization 4 | container-native-virtualization/ovs-cni-plugin-rhel9 | Fix deferred | n/a |
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/osp-director-operator-bundle | Fix deferred | n/a |
| Red Hat OpenStack Platform 17.1 | rhosp-rhel9/osp-director-operator-bundle | Fix deferred | n/a |
| Red Hat OpenStack Platform 18.0 | rhoso-operators/openstack-operator-bundle | Fix deferred | n/a |
| Red Hat OpenStack Platform 18.0 | rhoso-operators/rabbitmq-cluster-rhel9-operator | Fix deferred | n/a |
| Red Hat Trusted Artifact Signer | rhtas/policy-controller-rhel9-operator | Fix deferred | n/a |
| Red Hat Trusted Profile Analyzer | rhtpa/rhtpa-rhel9-operator | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
References (9)
- https://access.redhat.com/security/cve/CVE-2026-8261 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2468988 Issue Tracking
- https://github.com/albertodemichelis/squirrel/issues/326 exploitissue-tracking
- https://github.com/biniamf/pocs/tree/main/squirrel-sqobject-functionproto-load-intovf-lineinfos exploit
- https://nvd.nist.gov/vuln/detail/CVE-2026-8261
- https://vuldb.com/submit/809904 exploitthird-party-advisory
- https://vuldb.com/vuln/362558 vdb-entrytechnical-description
- https://vuldb.com/vuln/362558/cti signaturepermissions-required
- https://www.cve.org/CVERecord?id=CVE-2026-8261
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-8261 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2468988 | Issue Tracking | |
| https://github.com/albertodemichelis/squirrel/issues/326 | exploitissue-tracking | |
| https://github.com/biniamf/pocs/tree/main/squirrel-sqobject-functionproto-load-intovf-lineinfos | exploit | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-8261 | ||
| https://vuldb.com/submit/809904 | exploitthird-party-advisory | |
| https://vuldb.com/vuln/362558 | vdb-entrytechnical-description | |
| https://vuldb.com/vuln/362558/cti | signaturepermissions-required | |
| https://www.cve.org/CVERecord?id=CVE-2026-8261 |
Change history (0)
No recorded changes yet.