CVE-2026-13574
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability was found in LLVM up to version 22.1.6 in the GCRelocateInst::getBasePtr function within IntrinsicInst.cpp, which handles Bitcode files. Manipulation of input data can cause a heap-based buffer overflow. The attack requires local access, and the exploit has been publicly disclosed, although LLVM authors question whether this is a genuine security vulnerability.
Risk Assessment
A local attacker could exploit this vulnerability to execute code or cause a system crash, posing a risk to the integrity and availability of environments processing malicious Bitcode files.
Recommendation
It is recommended to update LLVM to a version newer than 22.1.6 if available, or apply temporary mitigations such as restricting Bitcode file processing to trusted users only.
Original NVD description (English source)
A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.