CVE-2025-15155

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-15155
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15155.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-15155
Published
2025-12-28T22:15:43.123Z
Modified
2026-03-15T22:51:37.861878Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A vulnerability was detected in floooh sokol up to 16cbcc864012898793cd2bc57f802499a264ea40. The impacted element is the function sgpipelinedescdefaults in the library sokol_gfx.h. The manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is identified as 5d11344150973f15e16d3ec4ee7550a73fb995e0. It is advisable to implement a patch to correct this issue.

References

Affected packages

Git / github.com/floooh/sokol

Affected ranges

Type
GIT
Repo
https://github.com/floooh/sokol
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5d11344150973f15e16d3ec4ee7550a73fb995e0

Affected versions

Other
bindings-cleanup
gles2
old-pixelformats
pre-bindings-cleanup
pre-feb2021-api-changes
pre-separate-samplers
pre-webgpu

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15155.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2025-12-13"
            }
        ]
    }
]
vanir_signatures 
[
    {
        "signature_version": "v1",
        "target": {
            "file": "sokol_gfx.h",
            "function": "_sg_pipeline_desc_defaults"
        },
        "source": "https://github.com/floooh/sokol/commit/5d11344150973f15e16d3ec4ee7550a73fb995e0",
        "deprecated": false,
        "digest": {
            "function_hash": "94840356769700928795018076944758753244",
            "length": 4208.0
        },
        "id": "CVE-2025-15155-14ac5051",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "sokol_gfx.h"
        },
        "source": "https://github.com/floooh/sokol/commit/5d11344150973f15e16d3ec4ee7550a73fb995e0",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "300265562143765136421017216344674475112",
                "68242965550044601929769393108300277421",
                "414442384948235178503105653800594129",
                "8635890151768549992650637051419541717"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-15155-c3e7884e",
        "signature_type": "Line"
    }
]