CVE-2025-15155: Floooh Sokol Buffer Overflow Vulnerability

CVE-2025-15155 Overview

CVE-2025-15155 is a stack-based buffer overflow vulnerability in the floooh sokol graphics library. The flaw resides in the _sg_pipeline_desc_defaults function within sokol_gfx.h. An attacker with local access and low privileges can manipulate pipeline descriptor input to trigger the overflow. The affected commit is 16cbcc864012898793cd2bc57f802499a264ea40, and the fix is committed as 5d11344150973f15e16d3ec4ee7550a73fb995e0. The exploit is publicly disclosed. Because sokol is a single-header library shipped without formal versioning, downstream applications must integrate the upstream patch directly.

Critical Impact

Local attackers can trigger a stack-based buffer overflow in applications that embed sokol_gfx.h, potentially corrupting stack memory in the host process.

Affected Products

• floooh sokol (single-header graphics library, sokol_gfx.h)
• Applications embedding sokol at or before commit 16cbcc864012898793cd2bc57f802499a264ea40
• Downstream projects that vendor sokol without applying commit 5d11344150973f15e16d3ec4ee7550a73fb995e0

Discovery Timeline

• 2025-12-28 - CVE-2025-15155 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15155

Vulnerability Analysis

The vulnerability affects _sg_pipeline_desc_defaults in sokol_gfx.h, a core function that normalizes pipeline descriptor structures before rendering. The function iterates over vertex attribute states and uses a_state->buffer_index to look up per-buffer offset data. The prior assertion only validated the upper bound of buffer_index, allowing negative or otherwise out-of-range values to pass into an array indexing operation. This results in a stack-based buffer overflow [CWE-121, CWE-787] when the indexed access writes or reads outside the bounds of the fixed-size auto-offset array. The issue is classified under [CWE-119] (improper restriction of operations within the bounds of a memory buffer). Exploitation requires local access to a process that consumes attacker-influenced pipeline descriptors.

Root Cause

The root cause is an incomplete bounds check. The original assertion validated only that buffer_index < SG_MAX_VERTEXBUFFER_BINDSLOTS and did not confirm that the index was non-negative. A signed integer with a negative value satisfies the upper-bound check but produces an out-of-bounds memory access when used as an array subscript against the stack-allocated auto_offset buffer.

Attack Vector

The attack requires local access. An attacker must supply a crafted vertex layout descriptor to an application that calls the sokol pipeline creation path. When the vulnerable function processes the descriptor, the malformed buffer_index value drives out-of-bounds access on the process stack.

// Patch: sokol_gfx.h - _sg_pipeline_desc_defaults
// Source: https://github.com/floooh/sokol/commit/5d11344150973f15e16d3ec4ee7550a73fb995e0
         if (a_state->format == SG_VERTEXFORMAT_INVALID) {
             break;
         }
-        SOKOL_ASSERT(a_state->buffer_index < SG_MAX_VERTEXBUFFER_BINDSLOTS);
+        SOKOL_ASSERT((a_state->buffer_index >= 0) && (a_state->buffer_index < SG_MAX_VERTEXBUFFER_BINDSLOTS));
         if (use_auto_offset) {
             a_state->offset = auto_offset[a_state->buffer_index];
         }

The patch adds a lower-bound assertion, ensuring buffer_index is non-negative before it is used to index auto_offset.

Detection Methods for CVE-2025-15155

Indicators of Compromise

• Unexpected crashes or stack corruption reports in processes that link sokol_gfx.h
• Assertion failures referencing SOKOL_ASSERT on buffer_index in debug builds
• Locally executed binaries loading crafted vertex layout data from untrusted files

Detection Strategies

• Perform a source dependency audit to identify vendored copies of sokol_gfx.h and compare their commit hash against 5d11344150973f15e16d3ec4ee7550a73fb995e0.
• Enable AddressSanitizer (ASan) in continuous integration builds to catch out-of-bounds stack accesses in _sg_pipeline_desc_defaults.
• Review any application code paths that populate sg_vertex_attr_state structures from user-controlled input.

Monitoring Recommendations

• Monitor endpoint telemetry for crash events (SIGSEGV, stack corruption, __stack_chk_fail) originating from sokol-based applications.
• Track file access patterns where local processes load scene, asset, or shader configuration files from user-writable directories.
• Alert on repeated abnormal terminations of the same process, which may indicate exploitation attempts against the vulnerable function.

How to Mitigate CVE-2025-15155

Immediate Actions Required

• Update vendored copies of sokol_gfx.h to include commit 5d11344150973f15e16d3ec4ee7550a73fb995e0 or later.
• Rebuild and redistribute all downstream binaries that statically embed sokol.
• Restrict local user ability to supply arbitrary vertex descriptor data to sokol-based applications.

Patch Information

The upstream fix is available in the sokol repository as commit 5d11344150973f15e16d3ec4ee7550a73fb995e0. Because sokol does not use formal version tags, integrators must pin to this commit or newer. Related discussion is tracked in GitHub Issue #1405 and Issue #1406. Additional advisory metadata is available at VulDB #338533.

Workarounds

• Validate buffer_index values in application code before passing vertex attribute state to sokol pipeline creation APIs.
• Compile with stack protection flags such as -fstack-protector-strong and -D_FORTIFY_SOURCE=2 to reduce exploitation reliability.
• Enable AddressSanitizer in development and QA builds to catch out-of-bounds writes prior to release.

# Pin sokol to the patched commit in a git submodule
git -C third_party/sokol fetch origin
git -C third_party/sokol checkout 5d11344150973f15e16d3ec4ee7550a73fb995e0

# Rebuild with stack protection and bounds checks
cc -O2 -fstack-protector-strong -D_FORTIFY_SOURCE=2 \
   -fsanitize=address -fno-omit-frame-pointer \
   -Ithird_party/sokol -c app.c -o app.o