CVE-2026-13573

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13573
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-13573.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-13573
Downstream
Published
2026-06-29T14:00:09.309Z
Modified
2026-07-11T03:55:19.082730713Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow
Details

A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability.

Database specific 
{
    "cna_assigner": "VulDB",
    "isDisputed": true,
    "cwe_ids": [
        "CWE-119",
        "CWE-121"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13573.json"
}
References

Affected packages

Git / github.com/llvm/llvm-project

Affected ranges

Type
GIT
Repo
https://github.com/llvm/llvm-project
Events
Introduced
4434dabb69916856b824f68a64b029c67175e532
Last affected
fc4aad7b5db3fff421df9a9637605b9ca5667881
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "22.1.0"
        },
        {
            "last_affected": "22.1.0"
        },
        {
            "introduced": "22.1.1"
        },
        {
            "last_affected": "22.1.1"
        },
        {
            "introduced": "22.1.2"
        },
        {
            "last_affected": "22.1.2"
        },
        {
            "introduced": "22.1.3"
        },
        {
            "last_affected": "22.1.3"
        },
        {
            "introduced": "22.1.4"
        },
        {
            "last_affected": "22.1.4"
        },
        {
            "introduced": "22.1.5"
        },
        {
            "last_affected": "22.1.5"
        },
        {
            "introduced": "22.1.6"
        },
        {
            "last_affected": "22.1.6"
        }
    ]
}

Affected versions

22.*
22.1.0
22.1.1
22.1.2
22.1.3
22.1.4
22.1.5
22.1.6
llvmorg-22.*
llvmorg-22.1.0
llvmorg-22.1.1
llvmorg-22.1.2
llvmorg-22.1.3
llvmorg-22.1.4
llvmorg-22.1.5
llvmorg-22.1.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-13573.json"