CVE-2026-13574: Heap-based Buffer Overflow in llvm llvm-project
A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.
AI Analysis
Technical Summary
This vulnerability involves a heap-based buffer overflow in the llvm-project's GCRelocateInst::getBasePtr function in llvm/lib/IR/IntrinsicInst.cpp affecting versions up to 22.1.6. Although an exploit has been publicly disclosed and local exploitation is possible, the LLVM project disputes the classification of this issue as a security vulnerability, citing that the behavior is outside their security scope. No official remediation or patch has been provided, and the vulnerability's existence remains uncertain.
Potential Impact
If exploitable, the vulnerability could allow local attackers with limited privileges to cause a heap-based buffer overflow, potentially leading to memory corruption. However, due to the vendor's position that this is not considered a security vulnerability, the practical impact and exploitability remain unclear.
Mitigation Recommendations
No official fix or patch is currently available. The LLVM project does not consider this a security vulnerability and has not issued remediation guidance. Users should monitor official LLVM communications for any updates or changes in status. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-13574: Heap-based Buffer Overflow in llvm llvm-project
Description
A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.
CVSS v4.0
Score 4.8medium
Affected software
pkg:github/llvm/llvm-projectcpe:2.3:a:llvm:llvm-project:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves a heap-based buffer overflow in the llvm-project's GCRelocateInst::getBasePtr function in llvm/lib/IR/IntrinsicInst.cpp affecting versions up to 22.1.6. Although an exploit has been publicly disclosed and local exploitation is possible, the LLVM project disputes the classification of this issue as a security vulnerability, citing that the behavior is outside their security scope. No official remediation or patch has been provided, and the vulnerability's existence remains uncertain.
Potential Impact
If exploitable, the vulnerability could allow local attackers with limited privileges to cause a heap-based buffer overflow, potentially leading to memory corruption. However, due to the vendor's position that this is not considered a security vulnerability, the practical impact and exploitability remain unclear.
Mitigation Recommendations
No official fix or patch is currently available. The LLVM project does not consider this a security vulnerability and has not issued remediation guidance. Users should monitor official LLVM communications for any updates or changes in status. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-28T18:47:39.506Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a42868627e9c7971906cde8
Added to database: 06/29/2026, 14:51:50 UTC
Last enriched: 07/14/2026, 08:57:27 UTC
Last updated: 08/13/2026, 12:41:08 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.