TI-2025-13696 Aliases CVE-2025-15013 GHSA-ff2p-7h68-73qg

floooh sokol sokol_gfx.h _sg_validate_pipeline_desc stack-based overflow

MEDIUM 55CWE-119Published 2025-12-22 · Updated 2025-12-22

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability was identified in floooh sokol up to 5d11344150973f15e16d3ec4ee7550a73fb995e0. The impacted element is the function _sg_validate_pipeline_desc in the library sokol_gfx.h. Such manipulation leads to stack-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The name of the patch is b95c5245ba357967220c9a860c7578a7487937b0. It is best practice to apply a patch to resolve this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00149 4th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
floooh	sokol	5d11344150973f15e16d3ec4ee7550a73fb995e0	—	No fix listed	CNA

sokol Vendorfloooh Affected 5d11344150973f15e16d3ec4ee7550a73fb995e0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-15013
2026-10-03 Alias added: GHSA-ff2p-7h68-73qg

References

Exploit 1

https://github.com/oneafter/1212/blob/main/stack1

Patch 1

https://github.com/seyhajin/sokol/commit/b95c5245ba357967220c9a860c7578a7487937b0

Other 2

TI-2025-13833 floooh sokol sokol_gfx.h _sg_pipeline_desc_defaults stack-based overflow CVSS 4.0MEDIUM 4.8
TI-2025-13643 floooh sokol sokol_gfx.h _sg_pipeline_common_init heap-based overflow CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences