High 7.8Published Dec 28, 2025

CVE-2025-15155A vulnerability was detected in floooh sokol up to 16cbcc864012898793cd2bc57f802499a264ea40.

Updated under an hour ago (2026-10-19 07:10 UTC)

Does this affect you?

It affects floooh sokol. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for floooh sokol

Exploited in the last 30 days

A vulnerability was detected in floooh sokol up to 16cbcc864012898793cd2bc57f802499a264ea40. The impacted element is the function _sg_pipeline_desc_defaults in the library sokol_gfx.h. The manipulation results in stack-based buffer overflow. The attack requires a local approach. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is identified as 5d11344150973f15e16d3ec4ee7550a73fb995e0. It is advisable to implement a patch to correct this issue.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-119, CWE-121, CWE-787
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Oct 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

floooh sokol floooh:sokol	through 2025-12-13	NVD

References

https://github.com/floooh/sokol/commit/5d11344150973f15e16d3ec4ee7550a73fb995e0patch
https://github.com/floooh/sokol/issues/1405exploit, issue-tracking
https://github.com/floooh/sokol/issues/1406#issuecomment-3649548096exploit, issue-tracking
https://github.com/oneafter/1212/blob/main/hbf1not-applicable
https://vuldb.com/?ctiid.338533permissions-required, vdb-entry
https://vuldb.com/?id.338533third-party-advisory, vdb-entry
https://vuldb.com/?submit.719823exploit, third-party-advisory, vdb-entry

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.