llvm: llvm-project: LLVM: Denial of service via heap-based buffer overflow in Bitcode File Handler

🗓️ 11 Apr 2026 00:15:28Reported by RedHatType

A local attacker can trigger a heap-based overflow in LLVM Bitcode File Handler's GCRelocateInst::getBasePtr, causing denial of service.

Reporter	Title	Published	Views	Family All 23
ATTACKERKB	CVE-2026-13574	29 Jun 202614:15	–	attackerkb
Circl	CVE-2026-13574	29 Jun 202620:15	–	circl
CVE	CVE-2026-13574	29 Jun 202614:15	–	cve
Cvelist	CVE-2026-13574 llvm llvm-project Bitcode File IntrinsicInst.cpp getBasePtr heap-based overflow	29 Jun 202614:15	–	cvelist
Debian CVE	CVE-2026-13574	29 Jun 202614:15	–	debiancve
EUVD	EUVD-2026-40118	29 Jun 202614:15	–	euvd
Tenable Nessus	Fedora 45 : python-llvmlite (2026-ebbaee3606)	6 Jul 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-13574	30 Jun 202600:00	–	nessus
NVD	CVE-2026-13574	29 Jun 202615:16	–	nvd
OSV	BELL-CVE-2026-13574	4 Jul 202606:02	–	osv

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	20251124	aarch64	clang	21.1.8-1.1.hum1	clang-21.1.8-1.1.hum1.aarch64.rpm
Red Hat Hardened Images	20251124	x86_64	clang	21.1.8-1.1.hum1	clang-21.1.8-1.1.hum1.x86_64.rpm
Red Hat Hardened Images	20251124	noarch	llvm-doc	21.1.8-1.1.hum1	llvm-doc-21.1.8-1.1.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-13574
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/llvm/llvm-project/
github	www.github.com/llvm/llvm-project/issues/199191
github	www.github.com/user-attachments/files/28142619/poc.zip
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-13574
vuldb	www.vuldb.com/cve/CVE-2026-13574
vuldb	www.vuldb.com/submit/844468
vuldb	www.vuldb.com/vuln/374582
vuldb	www.vuldb.com/vuln/374582/cti

15 Jul 2026 14:31Current

6.1Medium risk

Vulners AI Score6.1

CVSS 21.7

CVSS 3.13.3

CVSS 44.8

CVSS 33.3

EPSS0.00124

SSVC