Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-3010
CVE-2025-3010:
Linux Debian vulnerability analysis and mitigation
Overview
A vulnerability (CVE-2025-3010) has been identified in Khronos Group glslang version 15.1.0. The issue affects the function glslang::TIntermediate::isConversionAllowed in the file glslang/MachineIndependent/Intermediate.cpp. This vulnerability was disclosed on March 31, 2025, and is classified as problematic due to a null pointer dereference issue (NVD, GitHub Issue).
Technical details
The vulnerability is caused by a null pointer dereference in the glslang::TIntermediate::isConversionAllowed function. The issue occurs when the function fails to validate the 'node' parameter before attempting to call node->getBasicType(), resulting in a potential null pointer dereference. According to the CVSS v4.0 scoring, it has received a medium severity score of 4.8, with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (NVD).
Impact
The vulnerability can lead to application crashes when processing certain files, affecting the stability of applications using the glslang library. The attack requires local access to be executed, and while the impact is primarily limited to availability through crashes, it represents a reliability concern for systems utilizing the affected version (GitHub Issue).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management