CVE-2026-13574
llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow
CVSS Score
3.3
EPSS Score
0.1%
EPSS Percentile
3th
A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.
| CWE | CWE-122 CWE-119 |
| Vendor | llvm |
| Product | llvm-project |
| Published | Jun 29, 2026 |
| Last Updated | Jul 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for llvm llvm-project
Be the first to know when new low vulnerabilities affecting llvm llvm-project are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
llvm / llvm-project
22.1.0 22.1.1 22.1.2 22.1.3 22.1.4 22.1.5 22.1.6
References
vuldb.com: https://vuldb.com/vuln/374582 vuldb.com: https://vuldb.com/vuln/374582/cti vuldb.com: https://vuldb.com/cve/CVE-2026-13574 vuldb.com: https://vuldb.com/submit/844468 github.com: https://github.com/llvm/llvm-project/issues/199191 github.com: https://github.com/user-attachments/files/28142619/poc.zip github.com: https://github.com/llvm/llvm-project/
Credits
🔍 TYGLS (VulDB User) VulDB CNA Team