PT-2025-52501 · Unknown · Floooh Sokol+1

Oneafter · Published 2025-12-19 · Updated 2025-12-30 · CVE-2025-14958

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions floooh sokol versions prior to 33e2271c431bf21de001e972f72da17a984da932

Description A security flaw exists in floooh sokol. The issue resides in the sg pipeline common init function within the sokol gfx.h library, leading to a heap-based buffer overflow. Local exploitation is possible. The exploit is publicly available. The product employs a rolling release model, meaning specific version details for affected or updated releases are not available.

Recommendations Install the patch 33e2271c431bf21de001e972f72da17a984da932 to address this issue.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

CWE-119

Related Identifiers

CVE-2025-14958

Affected Products

Floooh Sokol

Sokol Gfx.H

References · 13

• 🔥 https://github.com/floooh/sokol/issues/1406#issuecomment-3649515551 · Exploit
• 🔥 https://github.com/floooh/sokol/issues/1406 · Exploit
• 🔥 https://vuldb.com/?submit.717320 · Exploit
• 🔥 https://github.com/oneafter/1212/blob/main/hbf1 · Exploit
• https://osv.dev/vulnerability/CVE-2025-14958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14958 · Security Note
• https://github.com/seyhajin/sokol/commit/33e2271c431bf21de001e972f72da17a984da932 · Patch
• https://twitter.com/VulmonFeeds/status/2002204883991007416 · Twitter Post
• https://vuldb.com/?ctiid.337594 · Note
• https://twitter.com/CVEnew/status/2002099127065457051 · Twitter Post
• https://vuldb.com/?id.337594 · Note
• https://t.me/CVEtracker/40296 · Telegram Post
• https://t.me/cveNotify/147207 · Telegram Post