{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13573", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-28T18:47:36.926Z", "datePublished": "2026-06-29T14:00:09.309Z", "dateUpdated": "2026-07-07T14:32:21.212Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-07T14:32:21.212Z"}, "title": "llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-121", "lang": "en", "description": "Stack-based Buffer Overflow"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "llvm", "product": "llvm-project", "versions": [{"version": "22.1.0", "status": "affected"}, {"version": "22.1.1", "status": "affected"}, {"version": "22.1.2", "status": "affected"}, {"version": "22.1.3", "status": "affected"}, {"version": "22.1.4", "status": "affected"}, {"version": "22.1.5", "status": "affected"}, {"version": "22.1.6", "status": "affected"}], "cpes": ["cpe:2.3:a:llvm:llvm-project:*:*:*:*:*:*:*:*"], "modules": ["ValueSymbolTable Module"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-06-28T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-28T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-07T16:37:07.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "TYGLS (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/374581", "name": "VDB-374581 | llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/374581/cti", "name": "VDB-374581 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-13573", "name": "CVE-2026-13573 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/844457", "name": "Submit #844457 | LLVM LLVM Project commit 3b3a3c2 Stack-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/llvm/llvm-project/issues/199187", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/28141697/poc.zip", "tags": ["broken-link", "exploit"]}, {"url": "https://github.com/llvm/llvm-project/", "tags": ["product"]}], "tags": ["disputed"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-29T15:23:01.490159Z", "id": "CVE-2026-13573", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T15:23:24.648Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13573", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T15:23:01.490159Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T15:23:19.394Z"}}], "cna": {"tags": ["disputed"], "title": "llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow", "credits": [{"lang": "en", "type": "reporter", "value": "TYGLS (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:llvm:llvm-project:*:*:*:*:*:*:*:*"], "vendor": "llvm", "modules": ["ValueSymbolTable Module"], "product": "llvm-project", "versions": [{"status": "affected", "version": "22.1.0"}, {"status": "affected", "version": "22.1.1"}, {"status": "affected", "version": "22.1.2"}, {"status": "affected", "version": "22.1.3"}, {"status": "affected", "version": "22.1.4"}, {"status": "affected", "version": "22.1.5"}, {"status": "affected", "version": "22.1.6"}]}], "timeline": [{"lang": "en", "time": "2026-06-28T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-28T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-07T16:37:07.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/374581", "name": "VDB-374581 | llvm llvm-project ValueSymbolTable ValueSymbolTable.cpp insert stack-based overflow", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/374581/cti", "name": "VDB-374581 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-13573", "name": "CVE-2026-13573 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/844457", "name": "Submit #844457 | LLVM LLVM Project commit 3b3a3c2 Stack-based Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://github.com/llvm/llvm-project/issues/199187", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/28141697/poc.zip", "tags": ["broken-link", "exploit"]}, {"url": "https://github.com/llvm/llvm-project/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The presence of this vulnerability remains uncertain at this time. The LLVM project explains, that the reported behavior is outside its documented security scope and therefore not considered a security vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "Stack-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-07T14:32:21.212Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13573", "state": "PUBLISHED", "dateUpdated": "2026-07-07T14:32:21.212Z", "dateReserved": "2026-06-28T18:47:36.926Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-29T14:00:09.309Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "llvm: llvm: Denial of Service via stack-based buffer overflow in StringMap::insert", "id": "2494424", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494424"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-120", "details": ["A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of the component ValueSymbolTable Module. The manipulation results in stack-based buffer overflow. Attacking locally is a requirement. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.", "A flaw was found in llvm. A local attacker could exploit a stack-based buffer overflow vulnerability in the `llvm::StringMap::insert` function. This manipulation could lead to a denial of service, making the affected system or application unavailable."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-13573", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "llvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "llvm-toolset:rhel8/clang", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "llvm-toolset:rhel8/llvm", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "clang", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "llvm", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "llvm14", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "llvm15", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "llvm20", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "llvm21", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "llvm", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "llvm21", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-06-29T14:00:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-13573\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-13573\nhttps://github.com/llvm/llvm-project/\nhttps://github.com/llvm/llvm-project/issues/199187\nhttps://github.com/user-attachments/files/28141697/poc.zip\nhttps://vuldb.com/cve/CVE-2026-13573\nhttps://vuldb.com/submit/844457\nhttps://vuldb.com/vuln/374581\nhttps://vuldb.com/vuln/374581/cti"], "threat_severity": "Low"}