CVE-2026-13574: LLVM Buffer Overflow Vulnerability

CVE-2026-13574 Overview

CVE-2026-13574 is a heap-based buffer overflow in the LLVM llvm-project compiler infrastructure through version 22.1.6. The flaw resides in the GCRelocateInst::getBasePtr function within llvm/lib/IR/IntrinsicInst.cpp, part of the Bitcode File Handler component. An attacker with local access can trigger the overflow by supplying a crafted bitcode file processed by affected LLVM tooling. A public proof-of-concept has been disclosed, and the LLVM project had not responded to the issue report at the time of publication. The weakness is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Local processing of a malicious LLVM bitcode file can corrupt heap memory in GCRelocateInst::getBasePtr, causing crashes or potential memory disclosure in developer toolchains and CI pipelines.

Affected Products

LLVM llvm-project up to and including version 22.1.6
Any downstream toolchain that links or embeds the affected LLVM IR/bitcode parsing library
Compiler and analysis utilities that invoke GCRelocateInst::getBasePtr when reading bitcode

Discovery Timeline

2026-06-29 - CVE-2026-13574 published to the National Vulnerability Database (NVD)
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13574

Vulnerability Analysis

The vulnerability lives inside LLVM's intermediate representation (IR) handling code. GCRelocateInst::getBasePtr is invoked when the bitcode reader encounters garbage-collection relocation intrinsics. When a bitcode file provides malformed operands to a gc.relocate intrinsic, the function accesses memory beyond the intended heap allocation. This out-of-bounds access constitutes a heap-based buffer overflow as classified under [CWE-119]. Because LLVM parses bitcode across many host tools such as opt, llc, llvm-dis, and JIT engines, any of these processes can inherit the flaw when they load attacker-supplied IR.

Root Cause

The function does not validate the structure or operand indices of the gc.relocate intrinsic before dereferencing them. Bitcode input drives operand counts, and the reader trusts them without bounds enforcement. When operand indices exceed the underlying heap buffer, the read or write escapes the allocation. The public proof-of-concept demonstrates that a crafted bitcode file reliably triggers the condition.

Attack Vector

Exploitation requires local access and low privileges. An attacker delivers a malicious .bc bitcode file to a target that runs an LLVM-based tool against it, such as a developer opening a project in an IDE that invokes clang, a build server compiling untrusted source, or a fuzzing harness parsing supplied IR. Successful triggering produces a memory corruption condition that can crash the tool or influence adjacent heap data. The publicly available proof-of-concept archive contains a bitcode sample sufficient to reproduce the fault.

No verified code example is available. See GitHub Issue #199191 and the VulDB CVE-2026-13574 entry for reproducer material and technical detail.

Detection Methods for CVE-2026-13574

Indicators of Compromise

Unexpected crashes, SIGSEGV signals, or AddressSanitizer heap-buffer-overflow reports emitted by opt, llc, clang, or other LLVM tools when reading .bc files
Presence of untrusted or unfamiliar bitcode artifacts in build inputs, package caches, or CI job workspaces
Core dumps whose stack traces include GCRelocateInst::getBasePtr or nearby frames in llvm/lib/IR/IntrinsicInst.cpp

Detection Strategies

Run LLVM tools under AddressSanitizer or Valgrind in development and CI environments to surface out-of-bounds accesses during bitcode parsing
Hash and inventory all .bc inputs consumed by build pipelines, then flag files sourced outside the trust boundary
Alert on process crashes of compiler binaries followed by unusual child-process activity on developer workstations and build agents

Monitoring Recommendations

Ship compiler and toolchain crash telemetry, including signal type and faulting module, to a centralized logging platform for correlation
Track invocations of LLVM utilities on build servers and record the input file paths for post-incident review
Monitor the LLVM Project repository for upstream fix commits referencing GCRelocateInst or issue #199191

How to Mitigate CVE-2026-13574

Immediate Actions Required

Refuse to compile or analyze bitcode files received from untrusted sources until an upstream patch lands
Isolate build and compilation jobs that handle third-party IR inside sandboxed containers or virtual machines with no persistent credentials
Enforce least privilege on developer accounts and CI runners so a local memory corruption event cannot pivot to broader system access

Patch Information

At the time of publication, the LLVM project had not responded to the issue report, and no fixed release is listed for versions up to and including 22.1.6. Track GitHub Issue #199191 and the LLVM Project repository for a corrective commit and apply the resulting minor release when it becomes available.

Workarounds

Reject .bc and other bitcode formats at the ingress of build pipelines that accept externally supplied artifacts
Rebuild LLVM with AddressSanitizer for non-production analysis workloads so overflow attempts terminate the process safely
Restrict execution of opt, llc, and clang to service accounts without write access to source, secrets, or artifact stores

bash

# Configuration example: block bitcode ingestion in a CI job
find ./inputs -type f \( -name '*.bc' -o -name '*.ll' \) -print -exec false {} +
if [ $? -ne 0 ]; then
  echo "Untrusted LLVM IR detected - aborting build (CVE-2026-13574)"
  exit 1
fi