Medium 5.3Published Dec 19, 2025

CVE-2025-14958floooh sokol sokol_gfx.h _sg_pipeline_common_init heap-based overflow

Updated under an hour ago (Oct 26, 2026, 2:30 PM ET)

Does this affect you?

It affects floooh sokol. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for floooh sokol

Exploited in the last 30 days

A security flaw has been discovered in floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932. This vulnerability affects the function _sg_pipeline_common_init in the library sokol_gfx.h. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be exploited. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 33e2271c431bf21de001e972f72da17a984da932. It is suggested to install a patch to address this issue.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Weakness (CWE): CWE-122, CWE-119
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Analyzed
Record last updated: Dec 19, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

floooh sokol floooh:sokol (from the name)	33e2271c431bf21de001e972f72da17a984da932	CNA record
floooh sokol floooh:sokol	through 2025-12-13	NVD

References

References

https://vuldb.com/?id.337594	vdb-entry, technical-description, third-party-advisory
https://vuldb.com/?ctiid.337594	signature, permissions-required, vdb-entry
https://vuldb.com/?submit.717320	third-party-advisory, exploit, vdb-entry
https://github.com/floooh/sokol/issues/1406	issue-tracking, exploit
https://github.com/floooh/sokol/issues/1406#issuecomment-3649515551	issue-tracking, exploit
https://github.com/oneafter/1212/blob/main/hbf1	exploit, product
https://github.com/seyhajin/sokol/commit/33e2271c431bf21de001e972f72da17a984da932	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.