CVE-2026-13574

Published Jun 29, 2026

Last updated 16 days ago

CVSS low 1.9
C++

Overview

Description
A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler. This manipulation causes heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. There are still doubts about whether this vulnerability truly exists. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.
Source
cna@vuldb.com
NVD status
Deferred
CNA Tags
disputed

Risk scores

CVSS 4.0

Type
Secondary
Base score
1.9
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
LOW

CVSS 3.1

Type
Secondary
Base score
3.3
Impact score
1.4
Exploitability score
1.8
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Severity
LOW

CVSS 2.0

Type
Secondary
Base score
1.7
Impact score
2.9
Exploitability score
3.1
Vector string
AV:L/AC:L/Au:S/C:N/I:N/A:P

Weaknesses

cna@vuldb.com
CWE-119

Social media

Hype score
Not currently trending

  1. 🚨*CVE* CVE-2026-13574 A vulnerability was determined in llvm llvm-project up to 22.1.6. This impacts the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of… https://t.co/FeEcLEd8Qe ----- Traducción: CVE-2026-13574 Se … https://t.co/utmtNg

    @infoflowcloud

    29 Jun 2026

    29 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not. This issue affects Apache Fory C++: from 0.14.0 before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.•CVE-2026-64608
  2. A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.•CVE-2026-13573
  3. Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.•CVE-2026-45591
  4. Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.•CVE-2026-32177
  5. Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.•CVE-2026-40372

References

Sources include official advisories and independent security research.