Bug 2494420 (CVE-2026-13574)

Summary:	CVE-2026-13574 llvm: llvm-project: LLVM: Denial of service via heap-based buffer overflow in Bitcode File Handler
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	alinfoot, bbrownin, dtrifiro, jkoehler, lphiri, rbryant, rhel-process-autobot, tuliom, watson-tool-maintainers, weaton
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	https://github.com/llvm/llvm-project/pull/208278
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in llvm. A local attacker could exploit a heap-based buffer overflow vulnerability in the GCRelocateInst::getBasePtr function within the Bitcode File Handler component. This flaw could lead to a denial of service, making the affected system unavailable.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2496375, 2496376, 2496377, 2496378, 2496379, 2496380, 2496381, 2496382, 2496383, 2496384, 2496385, 2496386, 2496387, 2496388, 2496389, 2496391, 2496392, 2496393, 2496394, 2496395, 2496396, 2496397, 2496398, 2496400, 2496402, 2496403, 2496390, 2496399, 2496401
Bug Blocks:

Description OSIDB Bzimport 2026-06-29 15:01:39 UTC

A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.