Vulnerability · Published Jun 29, 2026 · Assigned by VulDB
CVE-2026-13574llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow
Low 3.3
In plain English
A low-severity heap buffer overflow in llvm-project from llvm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Official description
A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | llvm-toolchain-18 | no fix listed | DEBIAN-CVE-2026-13574 |
| Debian:12 | llvm-toolchain-19 | no fix listed | DEBIAN-CVE-2026-13574 |
| Debian:13 | llvm-toolchain-19 | no fix listed | DEBIAN-CVE-2026-13574 |
| Debian:14 | llvm-toolchain-21 | no fix listed | DEBIAN-CVE-2026-13574 |
| Debian:12 | llvm-toolchain-22 | no fix listed | DEBIAN-CVE-2026-13574 |
| Debian:13 | llvm-toolchain-22 | no fix listed | DEBIAN-CVE-2026-13574 |
| Debian:14 | llvm-toolchain-22 | no fix listed | DEBIAN-CVE-2026-13574 |
| Ubuntu:24.04:LTS | llvm-toolchain-18 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:25.10 | llvm-toolchain-18 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:26.04:LTS | llvm-toolchain-18 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:26.10 | llvm-toolchain-18 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:24.04:LTS | llvm-toolchain-19 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:25.10 | llvm-toolchain-19 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:26.04:LTS | llvm-toolchain-19 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:26.10 | llvm-toolchain-19 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:25.10 | llvm-toolchain-21 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:26.04:LTS | llvm-toolchain-21 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:26.10 | llvm-toolchain-21 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:26.04:LTS | llvm-toolchain-22 | no fix listed | UBUNTU-CVE-2026-13574 |
| Ubuntu:26.10 | llvm-toolchain-22 | no fix listed | UBUNTU-CVE-2026-13574 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| llvm | llvm-project | 22.1.022.1.122.1.222.1.322.1.422.1.522.1.6 |
Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
References
- VDB-374582 | llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow vdb-entry, technical-description
- VDB-374582 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-13574 | CVE Analysis and Report third-party-advisory
- Submit #844468 | LLVM LLVM Project commit 3b3a3c2 Heap-based Buffer Overflow third-party-advisory
- https://github.com/llvm/llvm-project/issues/199191 issue-tracking
- https://github.com/user-attachments/files/28142619/poc.zip broken-link, exploit
- https://github.com/llvm/llvm-project/ product