EUVD-2026-40115
GHSA-p6v6-grg5-r9mw
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector with low-privilege access required to invoke LLVM tools; stack overflow produces a crash with no confidentiality or integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Stack-based buffer overflow in LLVM's ValueSymbolTable module (llvm-project versions up to 22.1.6) allows a local, low-privileged attacker to crash the LLVM process by triggering a malformed invocation of llvm::StringMap::insert in /lib/IR/ValueSymbolTable.cpp, resulting in limited availability impact only - no confidentiality or integrity compromise is indicated by the CVSS 4.0 vector. A proof-of-concept exploit has been publicly released, lowering the barrier to triggering the crash in affected developer or CI/CD environments. No active exploitation has been confirmed by CISA KEV, and the LLVM project had not issued a patch or public response as of disclosure.
Technical ContextAI
LLVM is a modular, open-source compiler infrastructure that underpins Clang, Swift, Rust, and numerous vendor toolchains. The vulnerable component is the ValueSymbolTable module (cpe:2.3:a:llvm:llvm-project:*:*:*:*:*:*:*:*), which manages named-value mappings within LLVM Intermediate Representation (IR) modules during compilation. The function llvm::StringMap::insert, located in /lib/IR/ValueSymbolTable.cpp, inserts string-keyed entries into a hash-map structure backed by stack-allocated memory. CWE-121 (Stack-based Buffer Overflow) identifies the root cause as insufficient bounds enforcement on that stack buffer, allowing a write beyond the allocated stack region when processing a specially crafted symbol or value name. This can corrupt adjacent stack frames, reliably crashing the LLVM process and, under precise memory layout conditions, potentially enabling code execution - though the CVSS vector's VA:L impact rating suggests the realistic outcome is a crash.
RemediationAI
No vendor-released patch has been identified at time of analysis - the LLVM project had not publicly responded to the GitHub disclosure at https://github.com/llvm/llvm-project/issues/199187 as of the reporting date. Upstream fix availability should be monitored at https://github.com/llvm/llvm-project/ and the VulDB entry at https://vuldb.com/cve/CVE-2026-13573. As compensating controls: restrict LLVM tool execution to trusted, internally generated LLVM IR and bitcode only, preventing any untrusted input from reaching the ValueSymbolTable codepath (trade-off: limits use of third-party or externally sourced LLVM modules); deploy process-level sandboxing such as seccomp profiles, Linux namespaces, or container isolation around LLVM-based compilation jobs to contain the blast radius of a process crash (trade-off: adds operational complexity to build pipelines); and instrument CI/CD environments to alert on unexpected LLVM process terminations, which can serve as an early indicator of exploitation attempts. These mitigations reduce impact but do not eliminate the underlying overflow condition.
More in Llvm Project
View allSame weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today