CVE-2026-13574: llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow

Vulnerability summary

CVE-2026-13574 is a medium (CVSS 4.8) vulnerability in llvm llvm-project. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-06-2026
   PublishedVulnerability first disclosed.
2. 07-07-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
• CWE-122Heap-based Buffer OverflowThe product writes past the end of a buffer that was allocated on the heap.