LLVM EUVD-2026-40115

Local, authenticated access with at least a low-privilege user account is required - confirmed by the CVSS 4.0 vector's AV:L and PR:L metrics. The attacker must have the ability to supply input to LLVM's IR or symbol-processing pipeline, for example by submitting a crafted LLVM IR or bitcode file to tools such as llc, opt, or a Clang-based compiler invocation, or by triggering symbol table operations via an LLVM API consumer. No special non-default configuration of LLVM is required to reach the vulnerable code path. Remote exploitation is not possible - the attack vector is explicitly local. Exploitation does not affect network services, default-configured servers, or environments where LLVM is not installed and executable by the attacker. The primary limiting factors are: (1) the requirement for local shell or equivalent access, (2) the availability-only impact ceiling indicated by the CVSS vector, and (3) the absence of a network-exposed attack surface.

The CVSS 4.0 base score of 1.9 (Very Low) accurately reflects a tightly scoped threat: local attack vector, low privileges required, no confidentiality or integrity impact, and only limited availability impact. The E:P environmental modifier embedded in the provided vector confirms publicly available exploit code, which is the primary risk amplifier for this CVE. EPSS data was not provided in the intelligence feed, so exploitation probability cannot be quantified. This vulnerability is not listed in the CISA KEV catalog, and no active exploitation is confirmed. The real-world risk is concentrated in developer workstations, CI/CD build pipelines, and environments that process untrusted or third-party LLVM IR or bitcode - not in production servers, network appliances, or typical enterprise infrastructure where LLVM is not directly invoked. The availability-only CVSS impact profile strongly suggests this is a crash/denial-of-service primitive rather than a code-execution path; achieving arbitrary code execution from a stack overflow in this context would require additional complexity not reflected in the CVSS metrics. Organizations running automated LLVM-based compilation of untrusted inputs should treat the public POC as a meaningful escalation signal despite the low base score.

A local attacker holding a low-privilege account on a developer workstation or CI/CD build host crafts a malicious LLVM IR file engineered to overflow the stack buffer in llvm::StringMap::insert during symbol table processing. The attacker submits this file to an LLVM-based tool such as llc, opt, or a Clang pipeline, causing the LLVM process to crash and disrupting any ongoing or automated compilation workload. A publicly available POC archive (https://github.com/user-attachments/files/28141697/poc.zip) demonstrates this crash, confirming exploitability requires minimal skill once local access is established.