CVE-2025-3010
Khronos Group glslang Intermediate.cpp isConversionAllowed null pointer dereference
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Khronos Group glslang Intermediate.cpp isConversionAllowed null pointer dereference
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Record
CVE-2025-3010- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 1.7
AV:L/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-476, CWE-404
- Updated
- 2026-11-02
EUVDEUVD-2025-8869
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Record
EUVD-2025-8869- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4m6w-jp94-34vc
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15...
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Record
GHSA-4m6w-jp94-34vc- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-404
- Updated
- 2026-11-02
NVD
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Record
CVE-2025-3010- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 1.7 Low
AV:L/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-404, CWE-476
- Updated
- 2026-11-02
OSV
Khronos Group glslang Intermediate.cpp isConversionAllowed null pointer dereference
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Record
CVE-2025-3010- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-404, CWE-476
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-3010
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Record
DEBIAN-CVE-2025-3010- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-3010
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Record
UBUNTU-CVE-2025-3010- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVAZL-59463 No score
CVE-2025-3010 affecting package glslang 14.0.0-2
A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
- Record
AZL-59463- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glslangAzure Linux:3 |
through 14.0.0-2 | None known |
glslangDebian:12 |
All versions, plus listed versions 12.0.0-212.2.0-113.0.0-113.1.1-113.1.1-2 Show 18 moreShow less13.1.1-314.0.0-114.0.0-214.1.0-114.2.0-114.3.0-115.0.0-115.1.0+1.4.309.0-115.1.0-115.1.0-215.4.0-116.0.0-116.0.0-216.0.0-316.1.0-116.2.0-116.2.0-216.4.0-1 |
None known |
glslangDebian:13 |
All versions, plus listed versions 15.1.0+1.4.309.0-115.4.0-116.0.0-116.0.0-216.0.0-3 Show 4 moreShow less16.1.0-116.2.0-116.2.0-216.4.0-1 |
None known |
glslangDebian:14 |
All versions, plus listed versions 15.1.0+1.4.309.0-115.4.0-116.0.0-116.0.0-216.0.0-3 Show 4 moreShow less16.1.0-116.2.0-116.2.0-216.4.0-1 |
None known |
glslangUbuntu:20.04:LTS |
All versions, plus listed versions 7.11.3214-17.12.3352-18.13.3559-4 |
None known |
glslangUbuntu:22.04:LTS |
All versions, plus listed versions 11.1.0-411.7.1-111.8.0+1.3.204.0-1 |
None known |
glslangUbuntu:24.04:LTS |
All versions, plus listed versions 12.2.0-114.0.0-215.1.0-2~ubuntu0.24.04.115.1.0-2~ubuntu0.24.04.2 |
None known |
glslangUbuntu:25.10 |
All versions, plus listed versions 15.1.0-215.1.0+1.4.309.0-115.4.0-1 |
None known |
glslangUbuntu:26.10 |
All versions, plus listed versions 16.2.0-216.4.0-1 |
None known |
glslangUbuntu:26.04:LTS |
All versions, plus listed versions 15.4.0-116.0.0-116.0.0-316.2.0-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-3010 is a medium vulnerability (CVSS 4.8) in Khronos Group Glslang, published March 31, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. No source names a fixed version.