Bug 2494420 (CVE-2026-13574) - CVE-2026-13574 llvm: llvm-project: LLVM: Denial of service via heap-based buffer overflow in Bitcode File Handler
Summary: CVE-2026-13574 llvm: llvm-project: LLVM: Denial of service via heap-based buf...
Keywords:
Status: NEW
Alias: CVE-2026-13574
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL: https://github.com/llvm/llvm-project/...
Whiteboard:
Depends On: 2496375 2496376 2496377 2496378 2496379 2496380 2496381 2496382 2496383 2496384 2496385 2496386 2496387 2496388 2496389 2496390 2496391 2496392 2496393 2496394 2496395 2496396 2496397 2496398 2496399 2496400 2496402 2496403 2496401
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-29 15:01 UTC by OSIDB Bzimport
Modified: 2026-07-13 18:11 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-29 15:01:39 UTC 
A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Note You need to log in before you can comment on or make changes to this bug.