{"id":"OSV-2025-447","aliases":[],"status":"published","title":"Use-of-uninitialized-value in spvtools::EmitNumericLiteral","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423059200\n\n```\nCrash type: Use-of-uninitialized-value\nCrash state:\nspvtools::EmitNumericLiteral\nspvtools::disassemble::InstructionDisassembler::EmitOperand\nspvtools::disassemble::InstructionDisassembler::EmitInstructionImpl\n```","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2025-06-09T00:05:11.128452Z","modified":"2026-10-20T17:25:41Z","affected":[{"source":"osv","ecosystem":"OSS-Fuzz","package":"spirv-tools","ranges":[{"type":"GIT","events":[{"introduced":"6061b72049a037215dfaba87399e1910a97b350e"}]}],"versions":["v2025.3.rc1","vulkan-sdk-1.4.321.0","v2025.4.rc1","vulkan-sdk-1.4.363.0","v2026.4.rc2","v2026.4","v2026.4.rc1","vulkan-sdk-1.4.357.0","v2026.3.rc1","v2026.3","vulkan-sdk-1.4.350.1","vulkan-sdk-1.4.350.0","v2026.2.rc2","v2026.2","v2026.2.rc1","vulkan-sdk-1.4.341.0","v2026.1.rc1","v2026.1","vulkan-sdk-1.4.335.0","v2025.5.rc1","v2025.5","vulkan-sdk-1.4.328.1","vulkan-sdk-1.4.328.0","v2025.4","v2025.3"]}],"references":[{"url":"https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423059200","tags":["report"]}],"sources":{"osv":[{"id":"OSV-2025-447","title":"Use-of-uninitialized-value in spvtools::EmitNumericLiteral","description":"OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423059200\n\n```\nCrash type: Use-of-uninitialized-value\nCrash state:\nspvtools::EmitNumericLiteral\nspvtools::disassemble::InstructionDisassembler::EmitOperand\nspvtools::disassemble::InstructionDisassembler::EmitInstructionImpl\n```\n","status":"published","published":"2025-06-09T00:05:11.128452Z","modified":"2026-10-20T17:25:41.214911785Z","updated_at":"2026-11-02T15:52:49.981578Z"}]}}