floooh sokol CVE-2025-14958

sokol is a lightweight graphics library written in C that abstracts graphics APIs. The vulnerability exists in the sokol_gfx.h header file, specifically in the _sg_pipeline_common_init function which handles initialization of graphics pipeline objects. The root cause is a heap-based buffer overflow (CWE-119) in buffer management during pipeline initialization. This suggests improper bounds checking when writing to dynamically allocated memory structures that hold pipeline configuration data. The attack vector is local (AV:L) with low complexity (AC:L), meaning an attacker with local system access can trigger the overflow without sophisticated techniques.