CVE-2026-13574

Name of the Vulnerable Software and Affected Versions llvm-project versions prior to 22.1.7

Description A heap-based buffer overflow occurs in the Bitcode File Handler component within the library llvm/lib/IR/IntrinsicInst.cpp. The issue is located in the GCRelocateInst::getBasePtr() function and can be exploited by a local attacker.

Recommendations Update llvm-project to version 22.1.7 or later. As a temporary mitigation, restrict access to the GCRelocateInst::getBasePtr() function.