This vulnerability in llvm-project (versions 22.1.0 through 22.1.6) involves a heap-based buffer overflow caused by improper handling in the function GCRelocateInst::getBasePtr located in llvm/lib/IR/IntrinsicInst.cpp. The issue allows local attackers to manipulate memory, potentially leading to memory corruption. The vulnerability was reported early to the project, but no response or fix has been provided as of the publication date. Exploit details have been publicly disclosed, but no known exploits in the wild have been confirmed.

The heap-based buffer overflow may allow a local attacker with limited privileges to cause memory corruption, which could lead to application crashes or potentially escalate privileges depending on the context of use. The CVSS score of 4.8 reflects a medium severity with local attack vector and low privileges required. There is no indication of remote exploitation or user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released and the vendor has not responded, users should monitor llvm-project advisories for updates. Until a patch is available, avoid running untrusted code that interacts with the affected component or consider applying manual code review or mitigations if feasible.