LLVM CVE-2026-13574

Exploitation requires the attacker to have an active local session on the target system with at least low-privilege user credentials, confirmed by CVSS AV:L and PR:L. The attacker must be able to supply a crafted bitcode (.bc) file as input to an LLVM tool that invokes the Bitcode File Handler, specifically triggering the GCRelocateInst::getBasePtr code path associated with GC relocation intrinsics. Systems where LLVM tools process only trusted, internally authored bitcode - such as locked-down CI runners with no external input ingestion - are not realistically exploitable without prior local compromise. Exploitation is further bounded by impact: the heap overflow results in a crash of the LLVM process (Availability: Low) with no confirmed confidentiality or integrity impact, limiting the attacker's gain to denial-of-service of the affected tool. Remote exploitation is not feasible given the local attack vector.

The CVSS 4.0 base score of 1.9 is consistent with the constrained attack surface: AV:L requires the attacker to already have local system access, PR:L requires low-privilege credentials, and the only confirmed impact is VA:L (low availability - a process crash). The supplemental E:P modifier confirms a POC exists, which marginally increases practical reproducibility but does not elevate the exploitability beyond local crash scenarios. No EPSS data was provided; given the local-only vector and narrow impact, exploitation probability in the wild is expected to be low. The vulnerability is absent from CISA KEV, confirming no observed active exploitation at time of analysis. Despite CWE-122 being a class historically associated with code execution primitives, the CVSS scoring assigns zero confidentiality and integrity impact, indicating the overflow results in a crash rather than controlled memory corruption. The primary real-world risk is a denial-of-service against LLVM-based build pipelines where externally sourced bitcode is processed. The absence of a vendor patch and the presence of a public POC are the two signals that warrant tracking, but overall priority is low given the local-only vector.

A local attacker with a standard unprivileged account on a developer workstation or CI build server crafts a malformed LLVM bitcode file that causes an out-of-bounds write when GCRelocateInst::getBasePtr processes an invalid GC relocation intrinsic operand. The attacker invokes an LLVM tool such as opt or llc against the crafted file, triggering a heap corruption that crashes the tool process. A proof-of-concept archive has been publicly released (https://github.com/user-attachments/files/28142619/poc.zip), lowering the barrier to reproduction.