Description
A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.
Published: 2026-06-29
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the GCRelocateInst::getBasePtr routine within LLVM’s Bitcode File Handler and may trigger a heap-based buffer overflow when processing a specially crafted .bc file. The vulnerability is tied to classic memory corruption weaknesses, such as CWE-119, CWE-122, and CWE-805. The description notes doubts about the existence of a true security flaw and that the LLVM project considers the behavior outside its documented security scope; this is treated as uncertain. Based on the description, it is inferred that a reliable overflow leading to code execution is not confirmed, and the risk remains limited to potential crashes or memory corruption if the overflow occurs.

Affected Systems

LLVM Project components up to release 22.1.6 are affected, specifically the Bitcode File Handler module of the compiler toolchain. Any installation that loads or processes .bc files using these versions is at risk.

Risk and Exploitability

The CVSS score of 4.8 is classified as low severity, and the EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, requiring the ability to cause an LLVM instance to parse a malicious bitcode file. The uncertain nature of the flaw’s existence reduces confidence in the risk assessment.

Generated by OpenCVE AI on August 5, 2026 at 02:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Avoid processing untrusted bitcode files; disable the bitcode loader when it is not required.
  • If bitcode processing is necessary, run the LLVM component in a sandboxed or isolated environment to contain any potential overflow.
  • Keep an eye on LLVM’s official announcements for confirmation of the issue and for any future fixes or workarounds.

Generated by OpenCVE AI on August 5, 2026 at 02:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.

Fri, 03 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-805
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 01 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 29 Jun 2026 15:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow
First Time appeared Llvm
Llvm llvm-project
Weaknesses CWE-119
CWE-122
CPEs cpe:2.3:a:llvm:llvm-project:*:*:*:*:*:*:*:*
Vendors & Products Llvm
Llvm llvm-project
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Llvm Llvm-project
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-07T14:32:28.820Z

Reserved: 2026-06-28T18:47:39.506Z

Link: CVE-2026-13574

cve-icon Vulnrichment

Updated: 2026-07-01T14:03:33.078Z

cve-icon NVD

Status : Deferred

Published: 2026-06-29T15:16:38.857

Modified: 2026-07-07T15:16:42.707

Link: CVE-2026-13574

cve-icon Redhat

Severity : Low

Publid Date: 2026-06-29T14:15:09Z

Links: CVE-2026-13574 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T03:00:13Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-122

    Heap-based Buffer Overflow

  • CWE-805

    Buffer Access with Incorrect Length Value