CVE-2025-14958

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in floooh sokol up to 33e2271c431bf21de001e972f72da17a984da932. This vulnerability affects the function _sg_pipeline_common_init in the library sokol_gfx.h. Performing manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be exploited. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The patch is named 33e2271c431bf21de001e972f72da17a984da932. It is suggested to install a patch to address this issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119CWE-122CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Dec 19, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-149599.8A weakness has been identified in code-projects Simple Stock System 1.0. This issue affects some unknown processing of the file /market/signCVE-2025-14966.5Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, AuthenticatiCVE-2025-149609.8A security vulnerability has been detected in code-projects Simple Blood Donor Management System 1.0. Impacted is an unknown function of theCVE-2025-149619.8A vulnerability was detected in code-projects Simple Blood Donor Management System 1.0. The affected element is an unknown function of the fCVE-2025-149626.1A flaw has been found in code-projects Simple Stock System 1.0. The impacted element is an unknown function of the file /market/chatuser.phpCVE-2025-149637.8A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the ability to gain elevatedCVE-2025-149649.8A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. SCVE-2025-149655.5A vulnerability was found in 1541492390c yougou-mall up to 0a771fa817c924efe52c8fe0a9a6658eee675f9f. This impacts the function upload/deleteCVE-2025-149667.2A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controlCVE-2025-149679.8A vulnerability was identified in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-149689.8A security flaw has been discovered in code-projects Simple Stock System 1.0. Affected by this issue is some unknown functionality of the fiCVE-2025-149694.3A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely clo