CVE-2026-13573
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A stack-based buffer overflow vulnerability exists in the LLVM library in the llvm::StringMap::insert function within ValueSymbolTable.cpp. The issue affects versions up to 22.1.6 and requires local access to exploit.
Risk Assessment
A local attacker could exploit this buffer overflow to cause system crashes or potentially escalate privileges. The risk is limited due to the required local access and the vendor's stance that this is not a security vulnerability.
Recommendation
Monitor LLVM project updates and consider temporary mitigations such as restricting local system access. If no official patch is provided, assess the risk and possibly block unauthorized local access.
Other vulnerabilities in LLVM
See all- CVE-2024-31852Low
LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. The vendor perspective is that they do not consider this a vulnerability.
- CVE-2023-29932Low
llvm-project commit fdbc55a5 was discovered to contain a segmentation fault via the component mlir::IROperand<mlir::OpOperand. This may lead to application crashes.
- CVE-2023-29941Low
llvm-project commit a0138390 was discovered to contain a segmentation fault via the component matchAndRewriteSortOp<mlir::sparse_tensor::SortOp>(mlir::sparse_tensor::SortOp. This may lead to application crashes.
- CVE-2023-26924Low
LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. Third parties dispute this because the LLVM security policy excludes language front-ends for which a malicious input file can cause undesirable behavior.
- CVE-2023-29933Low
llvm-project commit bd456297 was discovered to contain a segmentation fault via the component mlir::Block::getArgument. This may lead to application crashes.
- CVE-2023-29934Low
llvm-project commit 6c01b5c was discovered to contain a segmentation fault via the component mlir::Type::getDialect(). This may lead to application crashes.
- CVE-2023-29935Low
llvm-project commit a0138390 was discovered to contain an assertion failure at !replacements.count(op) && "operation was already replaced.". This may lead to application crashes.
- CVE-2023-29939Low
llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::spirv::TargetEnv::TargetEnv(mlir::spirv::TargetEnvAttr). This may lead to application crashes.
- CVE-2023-29942Low
llvm-project commit a0138390 was discovered to contain a segmentation fault via the component mlir::Type::isa<mlir::LLVM::LLVMVoidType. This may lead to application crashes.
- CVE-2026-13574Low
A vulnerability was found in LLVM up to version 22.1.6 in the GCRelocateInst::getBasePtr function within IntrinsicInst.cpp, which handles Bitcode files. Manipulation of input data can cause a heap-based buffer overflow. The attack requires local access, and the exploit has been publicly disclosed, although LLVM authors question whether this is a genuine security vulnerability.
Original NVD description (English source)
A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS