Bug 2494424 (CVE-2026-13573)

Summary: CVE-2026-13573 llvm: llvm: Denial of Service via stack-based buffer overflow in StringMap::insert
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: alinfoot, bbrownin, dtrifiro, jkoehler, lphiri, rbryant, rhel-process-autobot, watson-tool-maintainers, weaton
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in llvm. A local attacker could exploit a stack-based buffer overflow vulnerability in the `llvm::StringMap::insert` function. This manipulation could lead to a denial of service, making the affected system or application unavailable.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2495112, 2495113, 2495114, 2495115, 2495116, 2495117, 2495118, 2495119, 2495120, 2495121, 2495122, 2495123, 2495124, 2495125, 2495126, 2495127, 2495128, 2495129, 2495130, 2495131, 2495132, 2495133, 2495134, 2495135, 2495136, 2495137, 2495138, 2495140, 2495141, 2495142, 2495143, 2495144, 2495145, 2495146, 2495147, 2495148, 2495139    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-29 15:01:44 UTC 
A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.