CVE-2025-3010

LOW

Khronos Group glslang 15.1.0 - Null Pointer Dereference

Title source: llm

Description

A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

References (5)

[Permissions Required, VDB Entry] https://vuldb.com/?id.302060

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.302060

[Permissions Required, VDB Entry] https://vuldb.com/?submit.524561

[Issue Tracking] https://github.com/KhronosGroup/glslang/issues/3903

[Issue Tracking] https://github.com/KhronosGroup/glslang/issues/3903#issue-2927492534

Scores

CVSS v3 3.3

EPSS 0.0007

EPSS Percentile 21.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-404 CWE-476

Status published

Products (1)

Khronos Group/glslang 15.1.0

Published Mar 31, 2025

Tracked Since Feb 18, 2026