CVE-2025-15155
📋 TL;DR
A stack-based buffer overflow vulnerability exists in the _sg_pipeline_desc_defaults function of floooh sokol's sokol_gfx.h library. This allows local attackers to potentially execute arbitrary code or crash applications using this library. Any software incorporating vulnerable versions of the sokol library is affected.
💻 Affected Systems
- floooh sokol graphics library
📦 What is this software?
Sokol by Floooh
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise or remote code execution if combined with other vulnerabilities.
Likely Case
Application crash (denial of service) or limited local code execution within the application's context.
If Mitigated
Minimal impact if proper memory protections (ASLR, stack canaries) are enabled and the application runs with limited privileges.
🎯 Exploit Status
Exploit requires local access and specific manipulation of pipeline descriptor functions. Public exploit references exist in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 5d11344150973f15e16d3ec4ee7550a73fb995e0
Vendor Advisory: https://github.com/floooh/sokol/commit/5d11344150973f15e16d3ec4ee7550a73fb995e0
Restart Required: Yes
Instructions:
1. Update sokol library to commit 5d11344150973f15e16d3ec4ee7550a73fb995e0 or later. 2. Rebuild any applications using sokol_gfx.h. 3. Redeploy patched applications.
🔧 Temporary Workarounds
Disable vulnerable functionality
allAvoid using or restrict access to pipeline creation functions if possible in your application
🧯 If You Can't Patch
- Run applications with minimal privileges (non-admin/non-root accounts)
- Enable memory protection mechanisms (ASLR, stack canaries, DEP) at OS and compiler level
🔍 How to Verify
Check if Vulnerable:
Check if your sokol_gfx.h file contains commit hash earlier than 5d11344150973f15e16d3ec4ee7550a73fb995e0Check Version:
grep -i 'commit\|version' sokol_gfx.h | head -5Verify Fix Applied:
Verify sokol_gfx.h includes commit 5d11344150973f15e16d3ec4ee7550a73fb995e0 or later in the file header📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults or access violations when using graphics pipeline functions
- Unexpected process termination in applications using sokol
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Process:Terminated AND (ProcessName:your_application.exe OR ModulePath:*sokol*) AND ExitCode:0xC0000005🔗 References
- https://github.com/floooh/sokol/commit/5d11344150973f15e16d3ec4ee7550a73fb995e0
- https://github.com/floooh/sokol/issues/1405
- https://github.com/floooh/sokol/issues/1406#issuecomment-3649548096
- https://github.com/oneafter/1212/blob/main/hbf1
- https://vuldb.com/?ctiid.338533
- https://vuldb.com/?id.338533
- https://vuldb.com/?submit.719823
- https://vuldb.com/?submit.719823
