CVE-2026-13574 llvm CVE debrief

Who should care

Developers and users of llvm llvm-project up to version 22.1.6 should review and apply patches to prevent potential heap-based buffer overflow attacks. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impact on their systems.

Technical summary

The CVE-2026-13574 vulnerability was determined in llvm llvm-project up to version 22.1.6, impacting the function GCRelocateInst::getBasePtr in the library llvm/lib/IR/IntrinsicInst.cpp of the component Bitcode File Handler, potentially leading to a heap-based buffer overflow. The vulnerability has a CVSS score of 1.9 and is considered to be of low severity. Developers and users of llvm llvm-project up to version 22.1.6 should review and apply patches to prevent potential attacks. The LLVM project explains that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability. There are doubts about the existence of this vulnerability, and further verification is needed to confirm its impact.

Defensive priority

Low priority based on CVSS score of 1.9.

Recommended defensive actions

• Review and apply patches from the LLVM project
• Inventory and monitor systems using llvm llvm-project
• Consider compensating controls for Bitcode File Handler
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The LLVM project explains that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability. There are doubts about the existence of this vulnerability. The CVE record was published on 2026-06-29T15:16:38.857Z and has not been modified since then. The NVD entry is currently Deferred.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.