Vulnerability · Published Jun 29, 2026 · Assigned by VulDB
CVE-2026-13573llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow
Low 3.3
In plain English
A low-severity stack buffer overflow in llvm-project from llvm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | llvm-toolchain-18 | no fix listed | DEBIAN-CVE-2026-13573 |
| Debian:12 | llvm-toolchain-19 | no fix listed | DEBIAN-CVE-2026-13573 |
| Debian:13 | llvm-toolchain-19 | no fix listed | DEBIAN-CVE-2026-13573 |
| Debian:14 | llvm-toolchain-21 | no fix listed | DEBIAN-CVE-2026-13573 |
| Debian:12 | llvm-toolchain-22 | no fix listed | DEBIAN-CVE-2026-13573 |
| Debian:13 | llvm-toolchain-22 | no fix listed | DEBIAN-CVE-2026-13573 |
| Debian:14 | llvm-toolchain-22 | no fix listed | DEBIAN-CVE-2026-13573 |
| Ubuntu:24.04:LTS | llvm-toolchain-18 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:25.10 | llvm-toolchain-18 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:26.04:LTS | llvm-toolchain-18 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:26.10 | llvm-toolchain-18 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:24.04:LTS | llvm-toolchain-19 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:25.10 | llvm-toolchain-19 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:26.04:LTS | llvm-toolchain-19 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:26.10 | llvm-toolchain-19 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:25.10 | llvm-toolchain-21 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:26.04:LTS | llvm-toolchain-21 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:26.10 | llvm-toolchain-21 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:26.04:LTS | llvm-toolchain-22 | no fix listed | UBUNTU-CVE-2026-13573 |
| Ubuntu:26.10 | llvm-toolchain-22 | no fix listed | UBUNTU-CVE-2026-13573 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| llvm | llvm-project | 22.1.022.1.122.1.222.1.322.1.422.1.522.1.6 |
Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
References
- VDB-374581 | llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow vdb-entry, technical-description
- VDB-374581 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-13573 | CVE Analysis and Report third-party-advisory
- Submit #844457 | LLVM LLVM Project commit 3b3a3c2 Stack-based Buffer Overflow third-party-advisory
- https://github.com/llvm/llvm-project/issues/199187 issue-tracking
- https://github.com/user-attachments/files/28141697/poc.zip broken-link, exploit
- https://github.com/llvm/llvm-project/ product