floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932 sokol_gfx.h _sg_pipeline_common_init heap-based overflow

Summaryinfo

A vulnerability described as critical has been identified in floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932. This issue affects the function _sg_pipeline_common_init in the library sokol_gfx.h. Executing a manipulation can lead to heap-based overflow. The identification of this vulnerability is CVE-2025-14958. The attack can only be executed locally. Furthermore, there is an exploit available. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability has been found in floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932 and classified as critical. This vulnerability affects the function _sg_pipeline_common_init in the library sokol_gfx.h. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability.

The advisory is available at github.com. This vulnerability was named CVE-2025-14958. The exploitation appears to be easy. Local access is required to approach this attack. Technical details and also a public exploit are known.

It is possible to download the exploit at github.com. It is declared as proof-of-concept.

Applying the patch 33e2271c431bf21de001e972f72da17a984da932 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-204579). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

Name

Version

License

Website

CPE 2.3info

CPE 2.2info

CVSSv4info

VulDB Vector: 🔒
VulDB Reliability: 🔍

CNA CVSS-B Score: 🔒
CNA CVSS-BT Score: 🔒
CNA Vector: 🔒

CVSSv3info

VulDB Meta Base Score: 6.1
VulDB Meta Temp Score: 6.0

VulDB Base Score: 5.3
VulDB Temp Score: 4.8
VulDB Vector: 🔒
VulDB Reliability: 🔍

NVD Base Score: 7.8
NVD Vector: 🔒

CNA Base Score: 5.3
CNA Vector: 🔒

CVSSv2info

AVACAuCIA
💳💳💳💳💳💳
💳💳💳💳💳💳
💳💳💳💳💳💳
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍

Exploitinginfo

Class: Heap-based overflow
CWE: CWE-122 / CWE-119
CAPEC: 🔒
ATT&CK: 🔒

Physical: Partially
Local: Yes
Remote: No

Availability: 🔒
Access: Public
Status: Proof-of-Concept
Download: 🔒

EPSS Score: 🔒
EPSS Percentile: 🔒

Price Prediction: 🔍
Current Price Estimation: 🔒

0-DayUnlockUnlockUnlockUnlock
TodayUnlockUnlockUnlockUnlock

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Patch
Status: 🔍

0-Day Time: 🔒

Patch: 33e2271c431bf21de001e972f72da17a984da932

Timelineinfo

12/19/2025 Advisory disclosed
12/19/2025 +0 days VulDB entry created
12/30/2025 +11 days VulDB entry last update

Sourcesinfo

Product: github.com

Advisory: 1406
Status: Confirmed
Confirmation: 🔒

CVE: CVE-2025-14958 (🔒)
GCVE (CVE): GCVE-0-2025-14958
GCVE (VulDB): GCVE-100-337594
EUVD: 🔒
scip Labs: https://www.scip.ch/en/?labs.20161013

Entryinfo

Created: 12/19/2025 10:14
Updated: 12/30/2025 20:37
Changes: 12/19/2025 10:14 (61), 12/19/2025 19:58 (1), 12/20/2025 21:41 (30), 12/30/2025 20:37 (11)
Complete: 🔍
Submitter: Oneafter
Cache ID: 216::103

Submitinfo

Accepted

  • Submit #717320: floooh sokol e0832c9 Heap-based Buffer Overflow (by Oneafter)

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ PreviousOverviewNext ▸

Interested in the pricing of exploits?

See the underground prices here!