CVE-2026-13574 - Vulnerability Details

- llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow

Description

A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.

Published: 2026-06-29

Score: 4.8 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in LLVM’s Bitcode File Handler component, specifically the GCRelocateInst::getBasePtr function in IntrinsicInst.cpp, allows an attacker to trigger a heap-based buffer overflow by supplying a malicious bitcode file. The overflow arises from insufficient bounds checking on internal arrays, which is a classic memory corruption weakness (CWE-119, CWE-122, CWE-805). The vulnerability does not currently provide a documented path to arbitrary code execution, but it could lead to application crash or, if an attacker can influence trusted LLVM-backed components, potential memory corruption that could compromise integrity.

Affected Systems

The flaw targets the llvm:llvm-project library, affecting all releases up to version 22.1.6. The vulnerable code resides in the Bitcode File Handler module of the LLVM compiler toolchain, and only instances that load or process .bc files are at risk.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate level of expected impact, while the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is local: the attacker must have the ability to execute or coerce an LLVM instance to parse a crafted bitcode file and trigger the overflow.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

llvm

llvm-project

affected

Version	Status	Constraints
`22.1.0`	affected	—
`22.1.1`	affected	—
`22.1.2`	affected	—
`22.1.3`	affected	—
`22.1.4`	affected	—
`22.1.5`	affected	—
`22.1.6`	affected	—

No data.

Vendor Product Confidence Versions

Llvm

Llvm-project

95%

Version	Status	Scheme	Platform
`22.1.0`	affected	semver	—
`22.1.1`	affected	semver	—
`22.1.2`	affected	semver	—
`22.1.3`	affected	semver	—
`22.1.4`	affected	semver	—
`22.1.5`	affected	semver	—
`22.1.6`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade LLVM to a release newer than 22.1.6, which includes a patch that fixes the GCRelocateInst::getBasePtr bounds checking and removes the risk of buffer overflow (CWE-122, CWE-119, CWE-805).
Avoid loading untrusted bitcode files; isolate or disable the bitcode loader when not required and enforce strict input validation to mitigate overflow issues (CWE-119, CWE-122, CWE-805).
Enable runtime memory protection tools such as Address Sanitizer or Valgrind to detect and prevent buffer overflows (CWE-805).

Generated by OpenCVE AI on July 21, 2026 at 17:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00124.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/llvm/llvm-project/
https://github.com/llvm/llvm-project/issues/199191
https://github.com/user-attachments/files/28142619/poc.zip
https://nvd.nist.gov/vuln/detail/CVE-2026-13574
https://vuldb.com/cve/CVE-2026-13574
https://vuldb.com/submit/844468
https://vuldb.com/vuln/374582
https://vuldb.com/vuln/374582/cti
https://www.cve.org/CVERecord?id=CVE-2026-13574

History

Tue, 07 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description	A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.	A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.

Fri, 03 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-805
References		https://nvd.nist.gov/vuln/detail/CVE-2026-13574 https://www.cve.org/CVERecord?id=CVE-2026-13574
Metrics	threat_severity `None`	threat_severity `Low`

Wed, 01 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 29 Jun 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title		llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow
First Time appeared		Llvm Llvm llvm-project
Weaknesses		CWE-119 CWE-122
CPEs		cpe:2.3:a:llvm:llvm-project::::::::
Vendors & Products		Llvm Llvm llvm-project
References		https://github.com/llvm/llvm-project/ https://github.com/llvm/llvm-project/issues/199191 https://github.com/user-attachments/files/28142619/poc.zip https://vuldb.com/cve/CVE-2026-13574 https://vuldb.com/submit/844468 https://vuldb.com/vuln/374582 https://vuldb.com/vuln/374582/cti
Metrics		cvssV2_0 `{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Llvm Llvm-project

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-06-29T14:15:09.190Z

Updated: 2026-07-07T14:32:28.820Z

Reserved: 2026-06-28T18:47:39.506Z

Link: CVE-2026-13574

Vulnrichment

Updated: 2026-07-01T14:03:33.078Z

NVD

No data.

Redhat

Severity : Low

Publid Date: 2026-06-29T14:15:09Z

Links: CVE-2026-13574 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-21T18:00:04Z

Weaknesses

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-122
Heap-based Buffer Overflow
CWE-805
Buffer Access with Incorrect Length Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object